www.ranksays.com Open in urlscan Pro
2606:4700:3030::ac43:cdc9 Public Scan

Software

sffe /

Resource Hash

c961ef7cd6a93c0f1d0caa298df4f3240fc68ab8408fd64bf2a39cff2944f3f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "943 / 561 of 1000 / last-modified: 1627510277"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24670
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:45 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 98ms
35ms Script
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: cdBhoWYDE8U.miXtMaq72_QdUztpgDZw
content-encoding: gzip
server: Server
age: 428
etag: f8520ea4ebd91256d6b4f461d472242a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: public, max-age=900
date: Thu, 29 Jul 2021 01:00:37 GMT
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: t-Wof9882KyTiI4DS0xWNKVyAKXA09ToXMTrqo7ONGznuVULE7tqHA==

GET
H3-29 200 jellyfish.webp Show response
go.ezodn.com/porpoiseant/ 43 KB
11 KB 31ms
24ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/jellyfish.webp?a=a&cb=195-1&shcb=34
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e4148996d058adc797a2fe1a17d9046a27a6a9e9f5f13c0c01b21d6488b9aad

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4067537
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nkXnGk9%2B480BieeU7C5JXTYhxTdhGvWnXqd98OrSTcoQieOSQEZDpBoZ69zqPA4nLHxfL96W4CljPi0Yt8WfkLYwC4S0KIj4ylWAkHiY9J16cRM0H%2B64bI8gotKmwcOYKrFFYWuz8ROTjA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
cf-ray: 676273c3d8036431-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-robots-tag: noindex

GET
H3-29 200 banger.js Show response
go.ezodn.com/porpoiseant/ 45 KB
11 KB 27ms
19ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a949f5d9ce63c43a695313170bdeff41fa8481bb099f8fd411644d69bf398fd4

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 27007
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QFzFT05t11aFMmgds7zVveEl8BOVuNhJf6ydZUrVNB0FDWZK9sMn3ZUU4oeB%2B7cUBG4hzR92O%2B82qlh6qTTz70ho5TIsmTtf8rgoX3lBPIP3e9x9sjPu5wRP1LZ2TTVhgZkZcuQs7w2N%2FOk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
cf-ray: 676273c3d8026431-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-robots-tag: noindex

GET
H3-29 200 nmash.js Show response
go.ezodn.com/porpoiseant/ 24 KB
7 KB 18ms
17ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/nmash.js?v=40
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc48161214298afa70fd306b5a0a247f62c6042238e3dcadbd32015adedcc263

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 27041
cf-ray: 676273c3f80e6431-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 15:45:36 GMT
server: cloudflare
etag: W/"60c7-5c830e0a6d42b;5c701b9c2cf40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r7aeQUcD1Aocd3bSUZGLjMLH7egNsaUNcirKu%2FwEdLyBeSsUd1MPNg3Clfxw9SGLr2i8L1OS5SpmQsmRpdFwCcz8TlXVMqQ6qT4wjC3kvsmHON8z%2BHuUus46dBk03LnGBx0DYHWtkNUkSz0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H3-29 200 edmonton.webp Show response
go.ezodn.com/detroitchicago/ 21 KB
6 KB 18ms
17ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/edmonton.webp?a=a&cb=195-1&shcb=34
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f2343b12960f7a3779e4eec56029a2ac5f6f8ebf173a423a0451082a46203d0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4067532
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0eyLDmDDYoIfWiXjUfAGwSv%2BgydsHUZMedjkbyk3pMcTcPMcph%2FVzPKqPqqXQ4fvfN1EnBR60YNzi9D%2FCxGOlmsoC%2BzRWjEUN1L7WjUNRhByGikmO%2F6SuJjtyVIKVo06C1EN8mDhYK7CxWs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
cf-ray: 676273c3f8116431-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-robots-tag: noindex

GET
H3-29 200 vitals.js Show response
go.ezodn.com/tardisrocinante/ 4 KB
2 KB 14ms
14ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/tardisrocinante/vitals.js?gcb=195-1&cb=3
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 633411252cd3723532e0cb3c8c4214863de95cb26997c7ff3273aaf8f55d0d2a

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4067532
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u96o8yO0GCKmkZRgc7noI1MWUep6Dq6AB7c6TLPGhO8sxqSdhQPRAZJva7i77NaBYxm30Bc%2Bll0TdrTPv24ddvwq2FVVd%2F57RuJiR2GGakS3nvazdsFL0WIzSDzc%2FfjRc%2BOqTqz1Ww60%2FMI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
cf-ray: 676273c3f8126431-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-robots-tag: noindex

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 48ms
16ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.ranksays.com%2F&domain=www.ranksays.com&cw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.ranksays.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.ranksays.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1294
date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.ranksays.com%2F&domain=www.ranksays.com&cw=1
https://mug.criteo.com/sid?cpp=JJNG93xDOXVxM0ozV0ZQWjV0UjVCN1kycmJIWTFISTlYdTNkMlp6My8wT2txUzdjU0hCMFVpbUsvVXlaelNlWTBrVFM0M0F4WWRMT01xWGJkZzdqcE1VQ3NtNm9iU1JuZmpRTDd3bll3L2JvOFFDQnA0TjhHVUdWc2thc3...

347 B
603 B

87ms
31ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=JJNG93xDOXVxM0ozV0ZQWjV0UjVCN1kycmJIWTFISTlYdTNkMlp6My8wT2txUzdjU0hCMFVpbUsvVXlaelNlWTBrVFM0M0F4WWRMT01xWGJkZzdqcE1VQ3NtNm9iU1JuZmpRTDd3bll3L2JvOFFDQnA0TjhHVUdWc2thc3BHQzJ6dENYd3MyVHVvWEtidGlLQ1NCb0ZJOW5XV1AzMUxLcmx1RTBlWjdNcndQNHpjK2lVYytvQ1FEQjBIbnNjUGFjbG1WMmU1bDZmME9IRWtPQk9yVG96TjZGeEZtd0tGTUhlQndoazNYbjRBbEJHbmNZPXw&cppv=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

c85f5c35280b43c1949021f42061eb9da574ee3f684e8a4ad7410921cda27535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 29 Jul 2021 01:07:45 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2322
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Thu, 29 Jul 2021 01:07:45 GMT
location: https://mug.criteo.com/sid?cpp=JJNG93xDOXVxM0ozV0ZQWjV0UjVCN1kycmJIWTFISTlYdTNkMlp6My8wT2txUzdjU0hCMFVpbUsvVXlaelNlWTBrVFM0M0F4WWRMT01xWGJkZzdqcE1VQ3NtNm9iU1JuZmpRTDd3bll3L2JvOFFDQnA0TjhHVUdWc2thc3BHQzJ6dENYd3MyVHVvWEtidGlLQ1NCb0ZJOW5XV1AzMUxLcmx1RTBlWjdNcndQNHpjK2lVYytvQ1FEQjBIbnNjUGFjbG1WMmU1bDZmME9IRWtPQk9yVG96TjZGeEZtd0tGTUhlQndoazNYbjRBbEJHbmNZPXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1628
content-length: 482
expires: 0

POST
H/1.1 200
OK cookie_sync Show response
pb-server.ezoic.com/ 269 B
639 B 309ms
99ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/cookie_sync
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 14375082f18c8501a36b803a80a3489476d037a97867ffa2a1aae1b65df4fa57

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:46 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.ranksays.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 269
Expires: 0

POST
H/1.1 200
OK auction Show response
pb-server.ezoic.com/openrtb2/ 153 B
508 B 414ms
205ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/openrtb2/auction
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: d9f9af1963ce989f670a75c75e744cc7be7662592a34b649c395f5332b1a6b1b

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:46 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.ranksays.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 153
Expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
785 B 410ms
221ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: d36c7b7932f4727eb962f960a79c81d040ea31063de77d3f069c9cdcd682d04a

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 128
content-length: 355

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 728 B
1 KB 81ms
47ms XHR
application/json 185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

0a8c22907a8c0a12c598fb92c1aba610261436dbdc84908a274016bb00d26179

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 29 Jul 2021 01:07:46 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 07b48ed7-9b84-4d74-bfaa-6174fbb6213d
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.ranksays.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 mvo Show response
tag.1rx.io/rmp/215626/0/ 0
172 B 91ms
34ms XHR
text/plain 213.19.147.43
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=5.5,2.1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.43 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.ranksays.com
pragma: no-cache
date: Thu, 29 Jul 2021 01:07:46 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

POST
H2 204 hb Show response
hb.undertone.com/ 0
452 B 193ms
124ms XHR
text/plain 13.224.99.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=4009&domain=ranksays.com
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.99.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-99-85.zrh50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:45 GMT
via: 1.1 e92dffa8673a73c15c61e7c3abefc47d.cloudfront.net (CloudFront)
server: istio-envoy
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.ranksays.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
x-amz-cf-id: oAXZUIFETqPmKKJRHqLMKdZztvQkKPnxWfi8fOZfmXtPdQVDVlbBjQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
117 B 98ms
63ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.ranksays.com
date: Thu, 29 Jul 2021 01:07:44 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 724 B
1 KB 161ms
129ms XHR
application/json 185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

96a712a01feb7b3aa056aa5038ac88bcf57a8325747b4ce8401360ea4f29d855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 29 Jul 2021 01:07:46 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 06e5b3e7-9ce1-4dc5-828d-f4b01503d9d6
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.ranksays.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
285 B 73ms
37ms XHR
application/json 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.5.0&cb=74659934486
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

GET
H3-29 200 pubads_impl_2021072403.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
111 KB 61ms
31ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f33472fb0529099b682dcc4b94104ea70cec2d79d8ecca8875754a39a6d227ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 24 Jul 2021 15:22:29 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113953
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:46 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 35 B
75 B 59ms
30ms XHR
application/json 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c567b863e8676f0b46906fd837c4de82ad54bfa2a0250cffb604787b88be0885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:46 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
303 B 141ms
141ms XHR
text/plain 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: https://www.ranksays.com
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-id: aubLulQOKoY6cOB2tul-dGBapBJ3dp5DY6xGC-0sexntbVjvE9TctA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
372 B 71ms
71ms XHR
text/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&pid=cyav3lBUPdqh0&cb=0&ws=1600x1200&v=7.67.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-box-2%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-medrectangle-3%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-box-4%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-medrectangle-1%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-medrectangle-1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Franksays_com-medrectangle-1%22%7D%5D&cfgv=0&schain=1.0%2C1!ezoic.ai%2C1988fbec85666cade6e8cc67345fd74d%2C1%2C%2C%2C&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: Qc2SHSf8y6HFX8ahShkby8For00sfDfDEF4QexTb_wG59prvuO8Q5Q==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 112ms
48ms XHR
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UwMoja_wiYmXZ_L.v58hX8_8XzeYFzV9
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
x-amz-cf-pop: ZRH50-C1
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 22:05:10 GMT
server: AmazonS3
date: Thu, 29 Jul 2021 01:07:46 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 e92dffa8673a73c15c61e7c3abefc47d.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-id: rv_m_QXjUfxwDMm4A35trFSpblBq3SwDXiwTPq8sucmUlvICjET4og==

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 77ms
25ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1013
date: Thu, 29 Jul 2021 01:07:45 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
853 B 49ms
14ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 36ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 45 KB
11 KB 428ms
428ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=iid1%3D2118541971689774%26eid%3D2118541971689774%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dranksays_com-box-2-2118541971689774%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D60%26br2%3D28%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%252C168%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866182&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=275&adys=353&adks=2417951634&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=1050x0&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1050&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be670f095fb3d4f7d5e1d9c58472661f619c930730a419b76e3b5f125718191a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11026
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FEAA 6 KB
3 KB 46ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 29 Jul 2021 01:07:46 GMT
expires: Fri, 29 Jul 2022 01:07:46 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
11 KB 777ms
776ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid1%3D7399769415719509%26eid%3D7399769415719509%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dranksays_com-medrectangle-3-7399769415719509%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D24%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866190&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=275&adys=656&adks=2486398751&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=510x0&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=510&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c116956669a08d3250da9d24a9d826b1b7627c96178e97f0f99f6a654c1fe415

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10952
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 452 B
272 B 1392ms
1391ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid1%3D8683006199711509%26eid%3D8683006199711509%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26a%3D%257C379%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dranksays_com-box-4-8683006199711509%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D70%26br2%3D32%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866192&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=815&adys=926&adks=130617237&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=510x0&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=510&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90b56db7ecd1019efcd37358fec57f5a44b363255bfaf452d8ff71001bda7358

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
11 KB 1085ms
1085ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D34%252C13%252C120%252C67%252C51%252C0%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866193&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1814&adks=3943846486&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a320a2e9779ecebd4035d685f29b8aec014e697f88d2f1999f67718af103df2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10901
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 461 B
272 B 1945ms
1945ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D86%252C168%252C133%252C4%252C96%252C122%252C93%252C20%252C26%252C31%252C143%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866194&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=639&adys=1814&adks=3973230703&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e827842c36e40bb37f1c72a6605b36d260ca78fb4d9d3483fa7ac289336be57c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 461 B
280 B 1564ms
1564ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1312068367802860&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D1%26at%3Dmbf%26adr%3D416%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D83%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&cookie_enabled=1&bc=31&abxe=1&lmt=1627520866&dt=1627520866196&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=962&adys=1814&adks=383568383&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a27da9c18a9cb9b55559c0a1e88347e1c0f9c5fb3d7077d05b170f37e10d32c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame E668 2 KB
872 B 79ms
29ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

ee22f683394ec9d609b8c7b90e446dc4fde1cdcf0895322f7004078b5d3ed549

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 780
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK setuid
pb-server.ezoic.com/ Frame E668 0
465 B 100ms
100ms Image
text/plain 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pb-server.ezoic.com/setuid?bidder=onetag&gdpr=0&gdpr_consent=&uid=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:46 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 37ms
18ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021072403&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841ac69cee8354251f5610e8423720ede61f79334d5a6190e0f250c8ff02e7b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8427
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/032107240354000/ Frame E76B 188 KB
55 KB 31ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032107240354000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fcc2232fe58dcc85be853582a7ff6bf621c3e817164b1dfa57491534486b03a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 100651
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55206
x-xss-protection: 0
server: sffe
date: Tue, 27 Jul 2021 21:10:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "51cbfdbf3a4e7b1d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 21:10:15 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/032107240354000/v0/ Frame E76B 13 KB
5 KB 45ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032107240354000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1609bdcf4696c8146359638f33c35febdaba621dea00137283c61efc17504909

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 100651
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4865
x-xss-protection: 0
server: sffe
date: Tue, 27 Jul 2021 21:10:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ff227f97ed674b5b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 21:10:15 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/032107240354000/v0/ Frame E76B 87 KB
27 KB 42ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032107240354000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4075d8c0c312c24df5548f967cab5fbf808fe78fdcef9d4032bad92f6cacbb70

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 100651
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27852
x-xss-protection: 0
server: sffe
date: Tue, 27 Jul 2021 21:10:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "3719646983ab1de2"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 21:10:15 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/032107240354000/v0/ Frame E76B 4 KB
2 KB 45ms
20ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032107240354000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fbb36bdcd7fcb6a1962d355dccfab3262736d4d198a389ffb85a3fa3d2440d4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 100651
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1653
x-xss-protection: 0
server: sffe
date: Tue, 27 Jul 2021 21:10:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "687e73129cfc4c8d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 21:10:15 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/032107240354000/v0/ Frame E76B 40 KB
13 KB 44ms
19ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032107240354000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78e0bdeabeebc2dc279c8a9321a3c05dfee71e89123ee3d480fb83fe9d308aed

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 100651
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12828
x-xss-protection: 0
server: sffe
date: Tue, 27 Jul 2021 21:10:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4abe217821914203"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 21:10:15 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame E76B 5 KB
761 B 38ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:22:18 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:46 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame E76B 5 KB
1 KB 38ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 01:07:46 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:46 GMT

GET
DATA 200
OK truncated
/ Frame E76B 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e8f49a070c6d039d26417fe881797ca2ba23cf58fc21ed473215f51d7bbb67d

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E76B 0
0 58ms
57ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CEfRkYv8BYY3GDoGO7_UPiNiysA-u7_PLYs6E7MfZDcS2hp_-DhABIPT5xiVgkYSAgOwXoAGM99vdA8gBBqkCuV09aOvfsz7gAgCoAwHIAwqqBN8BT9CCG2kCMatSNJ4j2d-JqNxHKaplLWbW0Zy1yjS9NWRnFXKW-S5Lyp7txCyRgUKswAtkiwVdq6S4GR4ijaZfkxNkC0vNpjj57pGWOvj3GGkeagfvw4Thp0IU4pFnwPtEYSIkGrwQtXp7oZcOIRVuGqQFuUPB8uEiHyrWPwAp0xLcEs1NYdhGFfUxf4HBmTI4mAgng9CzgERxZ2aLQZSE6r1K7JOhBeXq143uXzXngfV4z15Z0X4eDcJMok2gLZnsc0bsmr2FE798JbBfPCdgR93LY2-7STfvpttb-_GPUcAE_sCsvboD4AQBkgUECAQYAZIFBAgFGASgBjeAB8bgxTSoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwUQpbeACNIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tODg0OTIyMDc1NzkyNjUzM4AKA8gLAdgTCtAVAYAXAbIXGgoYCAASFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4&sigh=9uZLixevBM0&template_id=492
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 204 l
www.google.com/ads/measurement/ Frame E76B 0
0 35ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRjgg7NABMTakt0ZQPxj35ucrujMCdwN-alqrszblF5e-T88DWpkiKJUL0Z3a8Tma4OOCbmXi3vESYQXRhZZoZkmd3z2Q
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E76B 2 KB
3 KB 8ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 03:19:18 GMT
x-content-type-options: nosniff
server: cafe
age: 78508
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 29 Jul 2021 03:19:18 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E76B 295 B
520 B 7ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 13:07:41 GMT
x-content-type-options: nosniff
server: cafe
age: 43205
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 29 Jul 2021 13:07:41 GMT

GET
H3-29 200 / Show response
basher.ezodn.com/ 1 KB
1 KB 23ms
12ms XHR
application/json 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://basher.ezodn.com/?did=19471&bf=70&dc=1254144
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/nmash.js?v=40
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 777c6488fa38ee522295145f5a11721d5eddb8329513669ced5583f40cf5ebe0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-PINGBACK: pingpong
Content-Type: application/json

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: br
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://www.ranksays.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qq0b2qMx%2BvqaVSaxCEwXXl3W31Y4dajsHpQ2JIV7HzfhlTxSO8RRe%2FVjPah%2FdrlYMN%2FSgYvhTtiETha%2BVYAgDJex%2BKYwzjbWfxvX8Y5QJ5K%2Bu6%2Bg2qSlXovb3563Tlrb0kyZ0a3%2F317mBmEhHFao"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 86400
cache-control: public, max-age=84400
cf-ray: 676273c8ccd94df4-FRA
access-control-allow-headers: Content-Type
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

OPTIONS
H2 200 /
basher.ezodn.com/ Frame 0
0 28ms
13ms Preflight
application/json 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://basher.ezodn.com/?did=19471&bf=70&dc=1254144
Protocol: H2
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type,x-pingback
Origin: https://www.ranksays.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-type: application/json
content-length: 0
access-control-allow-origin: https://www.ranksays.com
vary: Origin, Accept-Encoding
access-control-allow-headers: content-type,x-pingback
access-control-allow-methods: GET,POST,OPTIONS
access-control-max-age: 86400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IHG%2FMlvKJdJOjvsqzba2X2x1mAPqFcO8c6X%2Bkr1GZxBKvqio%2FlEEmDBhPrGP%2FDuyVcKcwjqNMv4ntwNfHMQFEU9B%2FklMx4BSbkkyYmK%2B0zC5d0hr63yuhtWKr%2BHC9K6O4DYug4UPoEjkDXvJ2JG"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 676273c8af172b1e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 greenoaks.gif Show response
g.ezoic.net/detroitchicago/ 0
181 B 80ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJkZXZpY2Vfd2lkdGgiLCJ2YWwiOiIxNjAwIn0seyJuYW1lIjoiZGV2aWNlX2hlaWdodCIsInZhbCI6IjEyMDAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA3LTI5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiZGF0YSI6W3sibmFtZSI6Imxhbmd1YWdlX3ByaW1hcnlfc3VidGFnIiwidmFsIjoiZW4ifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 greenoaks.gif Show response
g.ezoic.net/detroitchicago/ 0
43 B 81ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjIzMyJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiNTExIn0seyJuYW1lIjoicGVyZl9yZXNwX3RpbWUiLCJ2YWwiOiI1In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjE5OSJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjIwMSJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiIzNDcifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjY5NSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiI2OTUifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiMTAifV19XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:44 UTC

GET
H2 200 greenoaks.gif Show response
g.ezoic.net/detroitchicago/ 0
20 B 80ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiMTE3OCJ9XX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 79ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjIxMTg1NDE5NzE2ODk3NzQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImMzNTJiYTU4MWJkM2ZmZDhjZWE2MDhjZjJkNTVmNTE5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyMTE4NTQxOTcxNjg5Nzc0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDYsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA2LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjIxMTg1NDE5NzE2ODk3NzQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDQzNTIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyMTE4NTQxOTcxNjg5Nzc0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
43 B 80ms
25ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:46 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 92ms
37ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNy0yOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNCJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 78ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhdWN0aW9uX2Vwb2NoIjoxNjI3NTIwODY3LCJhZF9wb3NpdGlvbiI6MTEwOCwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImJpZF9mbG9vcl9pbml0aWFsIjo2MCwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjYwLCJhdWN0aW9uX2NvdW50IjoxLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo1MDMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 greenoaks.gif Show response
g.ezoic.net/detroitchicago/ 0
20 B 91ms
37ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTE4MSJ9XX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:46 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame E76B 15 KB
15 KB 34ms
14ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 196882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 18:26:24 GMT

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame E76B 44 KB
45 KB 22ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 19:47:58 GMT
x-content-type-options: nosniff
age: 191988
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 19:47:58 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame E76B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

34ms
14ms

Image
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Thu, 29 Jul 2021 01:07:46 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 0295 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 28 Jul 2021 21:36:56 GMT
expires: Thu, 28 Jul 2022 21:36:56 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12650
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EB5F 783 B
531 B 24ms
24ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7d225c1cbaaaae6cbd80116c21a168528bb5494f9da1b975f64598e89d051fc8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WIkC7fcH34tHWt0osJiOMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

expires: Thu, 29 Jul 2021 01:07:46 GMT
date: Thu, 29 Jul 2021 01:07:46 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-WIkC7fcH34tHWt0osJiOMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js Show response
pagead2.googlesyndication.com/bg/ Frame 0295 35 KB
13 KB 20ms
7ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e43a0788007c81c88e5f2e2d37edf449a9a0adff50ab76c8cb5b1c8ae76f5860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:52:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 108912
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13434
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:52:34 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021072403&jk=2148454575177760&bg=!CQqlCk7NAAals0SOpbM7ACkAdvg8WtFu_ffoE-PD-XAE9-ptNqCc5aiyefEnPDwpTdRLS-yL8i4ysgIAAABYUgAAAApoAQcKADMKKAHfrlp2WnpvdS1yiU0UFmEXU5p6O7nucTX-GOQNjHQV6qQpVfbpaZb-Lz6Vhtkqr7OZAntDvopDQFT7PUxg2pHVZzN_ChhALxI2LoJJLr2KeSg7huHxMLQvO-FflA90RlyDI-euCdELXfCdebAuJpPeG9PLyzjmZhHtuhQKUIQymSE8PLHcDOax5i1ECyth2SOH3cy_qWXI_t4GinroMT_uyL2xm0NJqSo0yeqUC1DYSx5tL5jIYV0Xh9Q3XgK209l6F4nR6cTXbTDxBE5r-QiTNxqVb_YpxxWtq-F7bb5wQwN1FquWV77-H8licKideYBR8MAdxuDXz6YJKgyBbT3T4WExT-eY3nyrNNA3J420d0CGAzZNUK0drivPjkPBueGAqsGSjjQo4tFgoPaF00jzR1NajG95HHNhh_sJPC-ceNJOaTqo7UaJ3NM9SDxCnBUyJvHXvcK6rF_XYmBg68Ti2mwJ9H4_yYx5zAF6YPdpm19tkVoOEGzPQYfsV7iSMW6LCQjqlvO7jMbWgsLEoFfyTV1CgGUni90eendFTiKPnrcqo3y3Tx1BnL2TiAwIUCk3revQvPSzLqLNVK7MmV2bGC2RqWkKZQviZM8EaNb5C_x_YyOUyNa5xzI5FPdwjs_hkJFmnBzTkR_Hj6nyhwKK1eMn2diECO0aU3fr5ZvpYarLfhhsf5-IAd7wiyTMOCWiMXJ670CCLLH24SzyeO8QJpO1Hr7sxkhUSu4xNNC79AcvFTteBGE_mIZ3b13YJhzs6mELIk4Zx8Bw0WScaIkH0glVdjUtsve7Bcrk5TxBoVkWXleOGdp1vHQ1MD_VtZDSNDnsZwHoxWDfCAxvyoDD672ExcuGTELvchXbnQ13JTTvO4Cstu5EUL4ZOa28ZbJ79EbojBE-rkI7cDn9jw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012107200040000/ Frame 6A53 188 KB
54 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d51b5c14fd6455affd3baceb0d2015c532566645fd80f645260c803a8b0f1c57

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55196
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a8830a242785ad6"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 6A53 13 KB
5 KB 32ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b4f1f72b78c93a6cdf32fbce758cc76e353e589296975f8491a265167cfdb0c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4808
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "82cb572e3b54d217"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 6A53 87 KB
27 KB 31ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

695be856611d9d209b70e4b7356594bd123af15d79843a3711289bf90e3525b1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27828
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "2309f93374d1f64f"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 6A53 4 KB
2 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0c3f2e5825816bcac42e686f0c3aa76e1aa566f71a437d8768702d4a3a45875

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1648
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0ef177dade489237"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 6A53 40 KB
13 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

172ecde3db13e66cf99995d63de308e2d6e3fdeb1a99dfaeec136f4862eb1573

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12831
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "896e0bc3d66ccdf5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 6A53 5 KB
688 B 31ms
17ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:53:38 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:47 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 6A53 5 KB
688 B 32ms
17ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:50:41 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:47 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6A53 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 03:19:18 GMT
x-content-type-options: nosniff
server: cafe
age: 78508
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 29 Jul 2021 03:19:18 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6A53 295 B
319 B 6ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 13:07:41 GMT
x-content-type-options: nosniff
server: cafe
age: 43205
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 29 Jul 2021 13:07:41 GMT

GET
DATA 200
OK truncated
/ Frame 6A53 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b31010fa8323ec192921a88675fe8c3863b93f2e8ce95ac3719a249bd564aadb

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6A53 0
0 58ms
57ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CZDCKYv8BYby_JNDC7_UPsNORiAXihP37Y-D_7OjQBwoQASD0-cYlYJGEgIDsF6AB4sjz2QPIAQGpAoDx7CZ8b7I-4AIAqAMByAMKqgTjAU_Qzhj7wkq7lkLKWDAOcj1J9LbCkeap02p0oM6pxK4sqOzCtYm-NKfq71NpIl1FO9bEySfGAfv5-j4CnDGbtvVf301UwkLfZmBOSzWRkkTDkoUk2LzXJnH8EmrfLuEqK_1gIS3KMkTr-oynquaPQ87UzxKA-X27lXskf6MgtVOEnotX82il4GrUdnbB9KxjHn7c6Xbtdcm8LZfc2g4RoklTQnagAlOaz1EjcZij8HDhbkYLtk8xARqTiBTZPYyEEHZ9YodH8jxAsQGgDpjqm26dwHbGPWRP5SCpHybV754HM4QHwATKq_femAHgBAGSBQQIBBgBkgUECAUYBKAGUYAHhreMJqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBRClpMMD0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi04ODQ5MjIwNzU3OTI2NTMzgAoDyAsB2BMMiBQF0BUBmBYBgBcBshcaChgIABIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=YxoERZ1AQ3w
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM5OTc2OTQxNTcxOTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczOTk3Njk0MTU3MTk1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjUyN2U1MmMxMDYzNWFjODEzNmE0Yzg0MDk0ZWU0OWE4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3Mzk5NzY5NDE1NzE5NTA5IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDcsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA3LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczOTk3Njk0MTU3MTk1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTg1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3Mzk5NzY5NDE1NzE5NTA5IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 29ms
29ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:47 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
43 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM5OTc2OTQxNTcxOTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNy0yOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNCJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzM5OTc2OTQxNTcxOTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhdWN0aW9uX2Vwb2NoIjoxNjI3NTIwODY3LCJhZF9wb3NpdGlvbiI6MTEwMiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImJpZF9mbG9vcl9pbml0aWFsIjo3MCwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjcwLCJhdWN0aW9uX2NvdW50IjoxLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo3OTAsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 6A53 15 KB
15 KB 19ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 196883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 18:26:24 GMT

GET
H3-29 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame 6A53 44 KB
44 KB 20ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 19:47:58 GMT
x-content-type-options: nosniff
age: 191989
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 19:47:58 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 6A53
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

28ms
14ms

Image
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Thu, 29 Jul 2021 01:07:47 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012107200040000/ Frame 5CB0 188 KB
54 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d51b5c14fd6455affd3baceb0d2015c532566645fd80f645260c803a8b0f1c57

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55196
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a8830a242785ad6"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 5CB0 13 KB
5 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b4f1f72b78c93a6cdf32fbce758cc76e353e589296975f8491a265167cfdb0c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4808
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "82cb572e3b54d217"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 5CB0 87 KB
27 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

695be856611d9d209b70e4b7356594bd123af15d79843a3711289bf90e3525b1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27828
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "2309f93374d1f64f"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 5CB0 4 KB
2 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0c3f2e5825816bcac42e686f0c3aa76e1aa566f71a437d8768702d4a3a45875

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1648
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0ef177dade489237"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012107200040000/v0/ Frame 5CB0 40 KB
13 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107200040000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

172ecde3db13e66cf99995d63de308e2d6e3fdeb1a99dfaeec136f4862eb1573

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 201560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12831
x-xss-protection: 0
server: sffe
date: Mon, 26 Jul 2021 17:08:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "896e0bc3d66ccdf5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:08:27 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 5CB0 5 KB
688 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:41:01 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:47 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 5CB0 5 KB
688 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83e1fc06d61560e19649771db56bc018fc7fdb56e98f3a9f74505230a8f35060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:39:27 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:47 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5CB0 2 KB
2 KB 10ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 03:19:18 GMT
x-content-type-options: nosniff
server: cafe
age: 78509
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 29 Jul 2021 03:19:18 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5CB0 295 B
319 B 10ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 28 Jul 2021 13:07:41 GMT
x-content-type-options: nosniff
server: cafe
age: 43206
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 29 Jul 2021 13:07:41 GMT

GET
DATA 200
OK truncated
/ Frame 5CB0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da7b152992a5125553bac4055eba56474fa39c7b5ed28c910cc8c10883d1b427

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5CB0 0
0 59ms
58ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C-OVXYv8BYfn4ObfC7_UPoOySiAWeyvLiYonH2pCDDq-BuuPXAhABIPT5xiVgkYSAgOwXoAGr6euCA8gBBuACAKgDAcgDCqoE7AFP0LB6tH9u09lHn_VxvaTwolOjG1uFYk_FLY-h6Ak3k6Vf9dPuIX8Mzjh9GJOI5gtxD68quamvcplotF5w5h3BMXN9XYbupUGaNBKE6RPv90hm0FQPclrJ0eOHYC4D_xsqx4O-wCAWdXsad5MxwkK5Ku2d98icS7VuqE4lblTrDWEZbfL_1sn5E0UFxnaw0NQj9J72NBUiSBBwg7ByhwWNH3LdHlxVh0WzO52o3kjwR7LLyuYs-mVDOqy3H_I0oBwU4hv0LIZJZBUHC4owQ88igzlG7-iw4nVUcGf0F_SAwCPh-BzMH0cfaj4iTcAEk52qv6wD4AQBkgUECAQYAZIFBAgFGASgBjeAB72WlH2oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQqYhz0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi04ODQ5MjIwNzU3OTI2NTMzgAoDyAsB2BMNiBQD0BUBmBYBgBcBshcaChgIABIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=Ig47jVbxUBo&template_id=492
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 5CB0 0
0 14ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS_wz8AfTEjb30p-vw7G_-GZem11tBE5_L0NAqYAuDQ9a83F6CzcGv3XAZmXnR0Ztmj3lUYEUznICWO01HPqwdAFJr43w
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczMDkyNzk3MDk3NDU0NDQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjUyN2U1MmMxMDYzNWFjODEzNmE0Yzg0MDk0ZWU0OWE4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzA5Mjc5NzA5NzQ1NDQ0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDcsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA3LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczMDkyNzk3MDk3NDU0NDQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjA4NjExMDk1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzA5Mjc5NzA5NzQ1NDQ0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:45 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 26ms
25ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:47 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
43 B 24ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNy0yOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNCJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:46 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhdWN0aW9uX2Vwb2NoIjoxNjI3NTIwODY3LCJhZF9wb3NpdGlvbiI6MTEwNywiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImJpZF9mbG9vcl9pbml0aWFsIjo3MCwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjcwLCJhdWN0aW9uX2NvdW50IjoxLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjoxMTAxLCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:46 UTC

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5CB0 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 196883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 18:26:24 GMT

GET
H3-29 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ Frame 5CB0 44 KB
44 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400|Roboto:400,500&text=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ranksays.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 19:47:58 GMT
x-content-type-options: nosniff
age: 191989
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 19:47:58 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5CB0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Thu, 29 Jul 2021 01:07:47 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
0 39ms
39ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gfp_cw_status&domain=ranksays.com&host=www.ranksays.com&success=1

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/detroitchicago/tulsa.js?gcb=195-1&cb=5

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E76B 42 B
64 B 41ms
40ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu-SZDLObcAmp-tQb2zQroOQ6aMvHw7U5UaKjFwMn3vsAMpfacBAOimwxG3Jm8QjAgtrGtTEG0P3iLv8EuM8M4ut-CUThgo_E9bbvAgGLb8wSsBuYyMrRcwZe7iIg&sai=AMfl-YToOkEYQuMcxsfyB-Dfo3Y9TyvY7_PNGZLFw7ShGzS9dK7_dRBJw-K7Q_GReQAziejjW0efY5rWFADNmUrKGHGc5j4pdnpEh-stzg4FPeQccZqVjx3xjZtYnNgEruw&sig=Cg0ArKJSzJZzxphAGaYXEAE&id=ampim&o=436,353&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=59&tls=1059&g=100&h=100&tt=1059&r=v&avms=ampa&adk=2417951634

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:47 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:46 UTC

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6A53 42 B
64 B 50ms
49ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstx2d5zzkq_r1CPEfTIAzw_Wrr6s-nDpdYzubGqd52-WDWO1zrelVyboF-oReOUbOvC2i7ri3_A-NJPljpd7Kzrq9KcJHV_Js6NePIuvSUgoUJHVbbbBcyCdI0Rgqz26UH6eRQ0kSUM2J-Bv_5nPzsojA&sai=AMfl-YTKntj_qFhk7_DRVW8tsPQmzcBjZEdL6AHff_R_3y6tGxWgIs8FiSn46v7etQYD3A4KwH6_LKZVwCEIg_CmCV_UPbb4m0DMi-KpOUT4keRRjJE9WaRSKIyySXE2YVQ&sig=Cg0ArKJSzAQH4daumeELEAE&id=ampim&o=275,656&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=51&tls=1051&g=100&h=100&tt=1051&r=v&avms=ampa&adk=2486398751

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
43 B 24ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM5OTc2OTQxNTcxOTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:46 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbNzI4LDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjIxMTg1NDE5NzE2ODk3NzQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxNjgifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:46 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
43 B 25ms
25ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzM5OTc2OTQxNTcxOTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczOTk3Njk0MTU3MTk1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3Mzk5NzY5NDE1NzE5NTA5IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:47 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczMDkyNzk3MDk3NDU0NDQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzA5Mjc5NzA5NzQ1NDQ0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:47 UTC

GET
H2 200 publishertag.prebid.105.js Show response
static.criteo.net/js/ld/ 80 KB
26 KB 49ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 83bcdfa5df8e5f84aa8715b0aefb06e9909b30290843475a0ecc6887650f811f

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
last-modified: Tue, 23 Feb 2021 11:00:30 GMT
server: nginx
etag: W/"6034e04e-14008"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 30 Jul 2021 01:07:49 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A769 291 B
724 B 16ms
15ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=www.ranksays.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

baf437304d79006a4f050b871807483c921e783a2a91808ad4b8f77802cde740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: gum.criteo.com
:scheme: https
:path: /syncframe?topUrl=www.ranksays.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

cache-control: private, max-age=0
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1562
set-cookie: uid=da83a8c9-37ca-4e77-83d0-78d0565e1375; expires=Tue, 23 Aug 2022 01:07:49 GMT; domain=.criteo.com; path=/; secure; samesite=none
date: Thu, 29 Jul 2021 01:07:48 GMT
content-length: 321

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 83 KB
27 KB 47ms
17ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 13be237d90d8262c74ae3985b06982b1b1c3d3c003b7ff093518e4bf944e9fd1

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
last-modified: Mon, 12 Jul 2021 10:59:58 GMT
server: nginx
etag: W/"60ec20ae-14aab"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 30 Jul 2021 01:07:49 GMT

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 213 B
534 B 106ms
31ms XHR
application/json 51.89.21.10
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.21.10 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p24.id5-sync.com

Software

Resource Hash

7a5d0313c53f4dcdcdc3f952d1c71a39b51f629b81e7ba4b146af4b603e9e353

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.ranksays.com
Date: Thu, 29 Jul 2021 01:07:49 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 043C 14 KB
5 KB 71ms
22ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?kdntuid=1&p=156983
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=31218
expires: Thu, 29 Jul 2021 09:48:07 GMT
date: Thu, 29 Jul 2021 01:07:49 GMT
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame B067 2 KB
823 B 26ms
25ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1627520866378

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?cb=1627520866378
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame F476 52 KB
17 KB 71ms
22ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.ranksays.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: icu=ChgIuOw6EAoYASABKAEw4v6HiAY4AUABSAEQ4v6HiAYYAA..; uuid2=2370592322880373369
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 21 Jul 2021 04:42:55 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 29 Jul 2021 01:07:49 GMT
Age: 73479
X-Served-By: cache-lga13620-LGA, cache-fra19160-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 2, 511152
X-Timer: S1627520869.440602,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 usersync.html Show response
cdn.undertone.com/js/ Frame 1E50 8 KB
3 KB 33ms
7ms Document
text/html 2600:9000:21f3:5800:1f:2473:9080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.undertone.com/js/usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:5800:1f:2473:9080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f0c6c17bbefb440a7e7ee03a4363aeba33a7c57345af065c670848e8fd40a4b5

Request headers

:method: GET
:authority: cdn.undertone.com
:scheme: https
:path: /js/usersync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

content-type: text/html
x-amz-replication-status: COMPLETED
last-modified: Thu, 08 Jul 2021 07:16:59 GMT
x-amz-version-id: 6994YJvhVK.G.S8wNruUeW.ksGihHjjx
server: AmazonS3
content-encoding: gzip
date: Thu, 29 Jul 2021 00:17:26 GMT
etag: W/"71d386aa3a4939b04d8b4f9c237f4eaf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 784dd167d622737126ee2d76985e7d3c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: CmsxzU0Vl980Im8bMtbA5T4tHDow4MsLdic120gwoOwEQEuk1-TxZw==
age: 3024

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B799 52 KB
17 KB 69ms
22ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,oftmedia,onetag,pubmatic,rhythmone,undertone&cb=195-1-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.ranksays.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: icu=ChgIuOw6EAoYASABKAEw4v6HiAY4AUABSAEQ4v6HiAYYAA..; uuid2=2370592322880373369
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 21 Jul 2021 04:42:55 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 29 Jul 2021 01:07:49 GMT
Age: 73479
X-Served-By: cache-lga13620-LGA, cache-fra19161-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 2, 489420
X-Timer: S1627520869.440676,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame D1F3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

281 B
554 B

69ms
22ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cdn.undertone.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Jul 2021 01:07:49 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=12776
Date: Thu, 29 Jul 2021 01:07:49 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 1E50
Redirect Chain

https://ib.adnxs.com/getuidnb?https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=$UID
https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2370592322880373369

0
154 B

411ms
102ms

Image
text/plain

54.210.227.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2370592322880373369
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.227.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-227-169.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:49 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: bf835ecd-f8c5-41c4-b342-de750f2eaa20
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2370592322880373369
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 1E50
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=1fb3be52-3d82-4d3e-b26c-93c68d38f633

0
308 B

403ms
101ms

Image
text/plain

54.210.227.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=1fb3be52-3d82-4d3e-b26c-93c68d38f633
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.227.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-227-169.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=1fb3be52-3d82-4d3e-b26c-93c68d38f633
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 1E50
Redirect Chain

https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP646821e7-f009-11eb-92bc-0691c8b76e1c
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP646821e7-f009-11eb-92bc-0691c8b76e1c&verify=true
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-EV9oJflE2uErnO4En3qDqSmpMmApx3WR~A~UP646821e7-f009-11eb-92bc-0691c8b76e1c

0
154 B

342ms
101ms

Image
text/plain

54.210.227.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-EV9oJflE2uErnO4En3qDqSmpMmApx3WR~A~UP646821e7-f009-11eb-92bc-0691c8b76e1c
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.227.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-227-169.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-envoy-upstream-service-time: 0
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Date: Thu, 29 Jul 2021 01:07:49 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-EV9oJflE2uErnO4En3qDqSmpMmApx3WR~A~UP646821e7-f009-11eb-92bc-0691c8b76e1c
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 1E50
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usr.undertone.com/userPixel/sync?partner=ttd&uid=7808c040-e0f9-446a-a7b7-794d1613141e&ttl=1630112869

0
154 B

389ms
102ms

Image
text/plain

54.210.227.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=7808c040-e0f9-446a-a7b7-794d1613141e&ttl=1630112869
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.227.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-227-169.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:49 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=7808c040-e0f9-446a-a7b7-794d1613141e&ttl=1630112869
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 247

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 1E50 0
239 B 95ms
23ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 1E50
Redirect Chain

https://cs.admanmedia.com/sync/undertone?url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpartner%3Dacuityads%26uid%3D%24UID
https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=368158da80f64442fa8bfbf0c590ed1e45c3d89b

0
154 B

303ms
101ms

Image
text/plain

54.210.227.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=368158da80f64442fa8bfbf0c590ed1e45c3d89b
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.227.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-227-169.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Location: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=368158da80f64442fa8bfbf0c590ed1e45c3d89b
Date: Thu, 29 Jul 2021 01:07:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 1E50
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=REU1RUZGRTgtMzc5Qy00RjU0LTlDMkItMzdDRDZBOEYzREFF&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

24ms
23ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug017:0:310
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 043C 5 KB
6 KB 51ms
16ms Script
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=60873409&p=156983&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: b8bc41ef72003422971878292a3c4ba848668a1c8513f970abad5767e0187ff0

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:48 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B799 0
727 B 16ms
16ms Script
text/html 185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:49 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: af8c6a2d-549b-4889-b13e-e662f13e5b2c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F476 0
727 B 16ms
16ms Script
text/html 185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:49 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b7e1c00c-41c8-4280-a982-6310171a677f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 31ms
17ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 450 B
262 B 392ms
392ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=3547100488230241&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D2%26at%3Dmbf%26adr%3D416%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D86%252C168%252C133%252C4%252C96%252C122%252C93%252C20%252C26%252C31%252C143%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520869490&eri=1&cookie=ID%3D411cee2dc8d93526-225c70b98fc80059%3AT%3D1627520866%3AS%3DALNI_MYjLf5dEYYRIG96cxDYJ2bWZAyZNA&bc=31&abxe=1&lmt=1627520869&dt=1627520869496&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=627&adys=1814&adks=3973230703&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aa1c449ff6a858fde55ba92d2227657b263f8fd149a0cea003ec14c57981a87b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 233
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 450 B
263 B 362ms
362ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=3810586133802308&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D2%26at%3Dmbf%26adr%3D416%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D70%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D83%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520869498&eri=1&cookie=ID%3D411cee2dc8d93526-225c70b98fc80059%3AT%3D1627520866%3AS%3DALNI_MYjLf5dEYYRIG96cxDYJ2bWZAyZNA&bc=31&abxe=1&lmt=1627520869&dt=1627520869501&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=962&adys=1814&adks=383568383&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2da0c81d1e0f4d9a3d15b5f125a3e538d98b1d9c1b298345e9a8ff9c2a70588a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 441 B
254 B 400ms
399ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=1908956994129137&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid1%3D8683006199711509%26eid%3D8683006199711509%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26a%3D%257C379%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D2%26at%3Dmbf%26adr%3D416%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dranksays_com-box-4-8683006199711509%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D70%26br2%3D32%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520869502&eri=1&cookie=ID%3D411cee2dc8d93526-225c70b98fc80059%3AT%3D1627520866%3AS%3DALNI_MYjLf5dEYYRIG96cxDYJ2bWZAyZNA&bc=31&abxe=1&lmt=1627520869&dt=1627520869504&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=815&adys=926&adks=130617237&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=510x0&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=510&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc.80.fd9f.ip4.static.sl-reverse.com

Software

cafe /

Resource Hash

9e2d49baac89f6834d99c01dde4a589d50fd072a8dc7e4e9d66a812e4da6264a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 4217
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=4149235A-DCB5-46D1-9F1D-54ED5497E453
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=4149235A-DCB5-46D1-9F1D-54ED5497E453

35 B
468 B

27ms
27ms

Document
image/gif

37.157.6.253
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=4149235A-DCB5-46D1-9F1D-54ED5497E453

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.253 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

s1.adform.net

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: c1.adform.net
:scheme: https
:path: /serving/cookie/match?CC=1&party=14&cid=4149235A-DCB5-46D1-9F1D-54ED5497E453
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: C=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 29 Jul 2021 01:07:49 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: uid=5803043218943384795; expires=Mon, 27 Sep 2021 01:07:49 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Thu, 29 Jul 2021 01:07:49 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=4149235A-DCB5-46D1-9F1D-54ED5497E453
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: C=1; expires=Sun, 29 Aug 2021 01:07:49 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

redir Show response
rtb-csync.smartadserver.com/ Frame 7151
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDZjJVN0NBXzhBQUZnVnBLQ1FqUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACf2U7CA_8AAFgVpKCQjQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_curre...

43 B
163 B

1087ms
25ms

Document
image/gif

185.86.138.143
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACf2U7CA_8AAFgVpKCQjQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.143 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Host: rtb-csync.smartadserver.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
content-type: image/gif
transfer-encoding: chunked

Redirect headers

Date: Thu, 29 Jul 2021 01:07:49 GMT
location: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AACf2U7CA_8AAFgVpKCQjQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 0
Connection: keep-alive

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 684E
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUIyOUY2NjYtOEQ0RS00QTQzLTg2Q0ItNUIyOTAxREQzQjVD&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUIyOUY2NjYtOEQ0RS00QTQzLTg2Q0ItNUIyOTAxREQzQjVD&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

25ms
24ms

Document
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: image8.pubmatic.com
:scheme: https
:path: /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: SPugT=1627520870; PUBMDCID=3; KRTBCOOKIE_860=16335-SsNlkYU0Rap5_JZ87s4auZ8wNwc; KRTBCOOKIE_218=22978-YQH-ZQADU_QhSQA4&KRTB&23194-YQH-ZQADU_QhSQA4&KRTB&23209-YQH-ZQADU_QhSQA4&KRTB&23244-YQH-ZQADU_QhSQA4; KRTBCOOKIE_22=14911-7470680919462327312; KRTBCOOKIE_377=6810-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&22918-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&23031-7808c040-e0f9-446a-a7b7-794d1613141e; KRTBCOOKIE_27=16735-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&16736-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23019-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23114-uid:06896101-ff65-4b00-81ce-5aac2fee2332; KRTBCOOKIE_594=17105-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003&KRTB&17107-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003; KRTBCOOKIE_308=22925-332381aa-def8-42a5-9477-82d8d7268d4c&KRTB&23158-332381aa-def8-42a5-9477-82d8d7268d4c; KRTBCOOKIE_279=22890-64ec1f0d-f009-11eb-9a77-7d04c1b82951&KRTB&23011-64ec1f0d-f009-11eb-9a77-7d04c1b82951; SyncRTB3=1628726400%3A220; ipc=0^^1^0; chkChromeAb67Sec=1; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; KRTBCOOKIE_80=22987-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&16514-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&23025-CAESEN1mX0ypZjg0SLeC_1hgW_o; PugT=1627520870
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
set-cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; chkChromeAb67Sec=2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure;
date: Thu, 29 Jul 2021 01:07:49 GMT

Redirect headers

server: nginx
date: Thu, 29 Jul 2021 01:07:50 GMT
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 27-Oct-2021 01:07:50 GMT; path=/
x-lat: lhrpug005:0:413
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 2BDD 0
44 B 292ms
95ms Document
text/plain 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: match.deepintent.com
:scheme: https
:path: /usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 0
date: Thu, 29 Jul 2021 01:07:49 GMT
server: a

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 5C0B
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4574621874
https://sync.1rx.io/usersync/tradedesk/7808c040-e0f9-446a-a7b7-794d1613141e
https://sync.targeting.unrulymedia.com/csync/RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUM4MkNBRTktNjA0QS00MENDLUI3MjctMEE4NTUwNjExODVG&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUM4MkNBRTktNjA0QS00MENDLUI3MjctMEE4NTUwNjExODVG&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

26ms
24ms

Document
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: image8.pubmatic.com
:scheme: https
:path: /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: SPugT=1627520870; PUBMDCID=3; KRTBCOOKIE_860=16335-SsNlkYU0Rap5_JZ87s4auZ8wNwc; KRTBCOOKIE_218=22978-YQH-ZQADU_QhSQA4&KRTB&23194-YQH-ZQADU_QhSQA4&KRTB&23209-YQH-ZQADU_QhSQA4&KRTB&23244-YQH-ZQADU_QhSQA4; KRTBCOOKIE_22=14911-7470680919462327312; KRTBCOOKIE_377=6810-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&22918-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&23031-7808c040-e0f9-446a-a7b7-794d1613141e; KRTBCOOKIE_27=16735-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&16736-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23019-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23114-uid:06896101-ff65-4b00-81ce-5aac2fee2332; KRTBCOOKIE_594=17105-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003&KRTB&17107-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003; KRTBCOOKIE_308=22925-332381aa-def8-42a5-9477-82d8d7268d4c&KRTB&23158-332381aa-def8-42a5-9477-82d8d7268d4c; KRTBCOOKIE_279=22890-64ec1f0d-f009-11eb-9a77-7d04c1b82951&KRTB&23011-64ec1f0d-f009-11eb-9a77-7d04c1b82951; SyncRTB3=1628726400%3A220; ipc=0^^1^0; chkChromeAb67Sec=1; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; KRTBCOOKIE_80=22987-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&16514-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&23025-CAESEN1mX0ypZjg0SLeC_1hgW_o; PugT=1627520870
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
set-cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; chkChromeAb67Sec=2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure;
date: Thu, 29 Jul 2021 01:07:50 GMT

Redirect headers

server: nginx
date: Thu, 29 Jul 2021 01:07:50 GMT
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 27-Oct-2021 01:07:50 GMT; path=/
x-lat: lhrpug007:0:420
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

GET
H/1.1 200
OK bridge Show response
cm.adgrx.com/ Frame 61BC 43 B
408 B 58ms
18ms Document
image/gif 72.251.241.206
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 72.251.241.206 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host: cm.adgrx.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Date: Thu, 29 Jul 2021 01:07:49 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
server: Cowboy
X-RealServer-NX: ams-delivery-4
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H/1.1

200
OK

noop Show response
px.owneriq.net/ Frame 000B
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

23ms
23ms

Document
image/gif

104.111.242.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.242.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-53.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: px.owneriq.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 0
Content-Type: image/gif
Date: Thu, 29 Jul 2021 01:07:49 GMT
Connection: keep-alive

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Thu, 29 Jul 2021 01:07:49 GMT
Connection: keep-alive

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame A721
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
442 B

761ms
759ms

Document
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method: GET
:authority: s.tribalfusion.com
:scheme: https
:path: /z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: ANON_ID=amnoeUy4ZawTBA9MGKDix5lkSFkMryblToOxd6NfU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=a6nsIHMZaAC6pqGpS71cNwsK2ZbgxI89NLjgrdDgKcS20DvV0a5etHaLGlm9TYZb3g0d4e2VPWWTI8EFM5UftZcHpd3J; path=/; domain=.tribalfusion.com; expires=Wed, 27-Oct-2021 01:07:50 GMT; SameSite=None; Secure; ANON_ID_old=a6nsIHMZaAC6pqGpS71cNwsK2ZbgxI89NLjgrdDgKcS20DvV0a5etHaLGlm9TYZb3g0d4e2VPWWTI8EFM5UftZcHpd3J; path=/; domain=.tribalfusion.com; expires=Wed, 27-Oct-2021 01:07:50 GMT;
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 676273dbbf7c4e97-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-type: text/html
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 206
x-reuse-index: 118
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=amnoeUy4ZawTBA9MGKDix5lkSFkMryblToOxd6NfU; path=/; domain=.tribalfusion.com; expires=Wed, 27-Oct-2021 01:07:49 GMT; SameSite=None; Secure; ANON_ID_old=amnoeUy4ZawTBA9MGKDix5lkSFkMryblToOxd6NfU; path=/; domain=.tribalfusion.com; expires=Wed, 27-Oct-2021 01:07:49 GMT;
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 676273dabe7b4e97-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AF4D
Redirect Chain

https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
https://um.simpli.fi/match_redirect?sifi_redir=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D6%26uuid%3D%24UID
https://match.bnmla.com/usersync?dspid=6&uuid=2C85C386F0DC4877BEC605DDE0817A57
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=332381aa-def8-42a5-9477-82d8d7268d4c
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzIyODdDQzgtN0I3Qi00REVCLTgxQjQtRkI4NTVBQ0JFN0M5&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzIyODdDQzgtN0I3Qi00REVCLTgxQjQtRkI4NTVBQ0JFN0M5&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

24ms
23ms

Document
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: image8.pubmatic.com
:scheme: https
:path: /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: SPugT=1627520870; PUBMDCID=3; KRTBCOOKIE_860=16335-SsNlkYU0Rap5_JZ87s4auZ8wNwc; KRTBCOOKIE_218=22978-YQH-ZQADU_QhSQA4&KRTB&23194-YQH-ZQADU_QhSQA4&KRTB&23209-YQH-ZQADU_QhSQA4&KRTB&23244-YQH-ZQADU_QhSQA4; KRTBCOOKIE_22=14911-7470680919462327312; KRTBCOOKIE_377=6810-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&22918-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&23031-7808c040-e0f9-446a-a7b7-794d1613141e; KRTBCOOKIE_27=16735-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&16736-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23019-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23114-uid:06896101-ff65-4b00-81ce-5aac2fee2332; KRTBCOOKIE_594=17105-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003&KRTB&17107-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003; KRTBCOOKIE_308=22925-332381aa-def8-42a5-9477-82d8d7268d4c&KRTB&23158-332381aa-def8-42a5-9477-82d8d7268d4c; KRTBCOOKIE_279=22890-64ec1f0d-f009-11eb-9a77-7d04c1b82951&KRTB&23011-64ec1f0d-f009-11eb-9a77-7d04c1b82951; SyncRTB3=1628726400%3A220; ipc=0^^1^0; chkChromeAb67Sec=1; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; KRTBCOOKIE_80=22987-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&16514-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&23025-CAESEN1mX0ypZjg0SLeC_1hgW_o; PugT=1627520870
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
set-cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; chkChromeAb67Sec=2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure;
date: Thu, 29 Jul 2021 01:07:50 GMT

Redirect headers

server: nginx
date: Thu, 29 Jul 2021 01:07:50 GMT
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 27-Oct-2021 01:07:50 GMT; path=/
x-lat: lhrpug009:0:430
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 1CD3
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=SsNlkYU0Rap5_JZ87s4auZ8wNwc
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MEExMEZGMUYtOUIzQS00OTA1LUE2REQtNkUxNUYxRjg3ODJE&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MEExMEZGMUYtOUIzQS00OTA1LUE2REQtNkUxNUYxRjg3ODJE&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

26ms
25ms

Document
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: image8.pubmatic.com
:scheme: https
:path: /AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: SPugT=1627520870; PUBMDCID=3; KRTBCOOKIE_860=16335-SsNlkYU0Rap5_JZ87s4auZ8wNwc; KRTBCOOKIE_218=22978-YQH-ZQADU_QhSQA4&KRTB&23194-YQH-ZQADU_QhSQA4&KRTB&23209-YQH-ZQADU_QhSQA4&KRTB&23244-YQH-ZQADU_QhSQA4; KRTBCOOKIE_22=14911-7470680919462327312; KRTBCOOKIE_377=6810-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&22918-7808c040-e0f9-446a-a7b7-794d1613141e&KRTB&23031-7808c040-e0f9-446a-a7b7-794d1613141e; KRTBCOOKIE_27=16735-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&16736-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23019-uid:06896101-ff65-4b00-81ce-5aac2fee2332&KRTB&23114-uid:06896101-ff65-4b00-81ce-5aac2fee2332; KRTBCOOKIE_594=17105-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003&KRTB&17107-RX-bc08442c-5674-42e5-885a-5eb8d9d7f19e-003; KRTBCOOKIE_308=22925-332381aa-def8-42a5-9477-82d8d7268d4c&KRTB&23158-332381aa-def8-42a5-9477-82d8d7268d4c; KRTBCOOKIE_279=22890-64ec1f0d-f009-11eb-9a77-7d04c1b82951&KRTB&23011-64ec1f0d-f009-11eb-9a77-7d04c1b82951; SyncRTB3=1628726400%3A220; ipc=0^^1^0; chkChromeAb67Sec=1; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; KRTBCOOKIE_80=22987-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&16514-CAESEN1mX0ypZjg0SLeC_1hgW_o&KRTB&23025-CAESEN1mX0ypZjg0SLeC_1hgW_o; PugT=1627520870
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
set-cookie: ipc=; domain=pubmatic.com; path=/; max-age=0; SameSite=None; secure; KADUSERCOOKIE=C2287CC8-7B7B-4DEB-81B4-FB855ACBE7C9; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure; chkChromeAb67Sec=2; domain=pubmatic.com; path=/; max-age=7776000; SameSite=None; secure;
date: Thu, 29 Jul 2021 01:07:50 GMT

Redirect headers

server: nginx
date: Thu, 29 Jul 2021 01:07:50 GMT
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 27-Oct-2021 01:07:50 GMT; path=/
x-lat: lhrpug019:0:493
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 56AE
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
147 B

1088ms
30ms

Document
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: match.taboola.com
:scheme: https
:path: /sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: t_gid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
accept-ranges: bytes
date: Thu, 29 Jul 2021 01:07:50 GMT
via: 1.1 varnish
x-served-by: cache-fra19131-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1627520871.630347,VS0,VE8
content-length: 0

Redirect headers

server: nginx
set-cookie: t_gid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5;Version=1;Path=/;Domain=.taboola.com;Expires=Fri, 29-Jul-2022 01:07:49 GMT;Max-Age=31536000;Secure;SameSite=None
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=2895362d-58eb-4f42-9158-1fbe8d081db8-tuct7fb84e5&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges: bytes
date: Thu, 29 Jul 2021 01:07:49 GMT
via: 1.1 varnish
x-served-by: cache-fra19169-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1627520870.549418,VS0,VE9
x-vcl-time-ms: 9
content-length: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 043C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QUkjWty1RtGfHVTtVJfkUw%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

23ms
22ms

Image
text/html

2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=31218
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Thu, 29 Jul 2021 09:48:07 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 420486.gif
idsync.rlcdn.com/ Frame 043C 0
66 B 58ms
21ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/420486.gif?partner_uid=4149235A-DCB5-46D1-9F1D-54ED5497E453
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7ec56101-ff65-4f00-a48d-b418ccc750e5

0
260 B

1068ms
16ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7ec56101-ff65-4f00-a48d-b418ccc750e5
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 29 Jul 2021 01:10:46 GMT
Server: MT3 3810 5cb7d7e master cdg-pixel-x3
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7ec56101-ff65-4f00-a48d-b418ccc750e5
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 29 Jul 2021 01:10:45 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDE0OTIzNUEtRENCNS00NkQxLTlGMUQtNTRFRDU0OTdFNDUz&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

24ms
23ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug012:0:393
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEN1mX0ypZjg0SLeC_1hgW_o&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

25ms
24ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug010:0:451
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 pubmatic
um.simpli.fi/ Frame 043C 43 B
611 B 59ms
17ms Image
image/gif 159.253.128.188
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.253.128.188 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 28 Jul 2021 01:07:49 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7470680919462327312&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjIyQkNDQkItNzQzQy00RDI2LUI2NzMtNjQxNDAzNkI3MUI5&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjIyQkNDQkItNzQzQy00RDI2LUI2NzMtNjQxNDAzNkI3MUI5&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

42ms
23ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug014:0:368
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YQH-ZQADU_QhSQA4&gdpr=0&gdpr_consent=&_test=YQH-ZQADU_QhSQA4
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjQzOTU1MTctNEY2MS00MTQzLUExOTgtN0UyODQ3QTg3OUU2&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjQzOTU1MTctNEY2MS00MTQzLUExOTgtN0UyODQ3QTg3OUU2&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

26ms
24ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug006:0:424
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7808c040-e0f9-446a-a7b7-794d1613141e
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUFCRkRFNzctMkMwNC00NjRFLTk0OTEtMjJFN0JENTg0NjlF&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUFCRkRFNzctMkMwNC00NjRFLTk0OTEtMjJFN0JENTg0NjlF&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

25ms
24ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug003:0:412
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:06896101-ff65-4b00-81ce-5aac2fee2332&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0NEQzc1ODMtN0NGMC00QUI3LUE5QUItMDcyRDAwMTgwODg2&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0NEQzc1ODMtN0NGMC00QUI3LUE5QUItMDcyRDAwMTgwODg2&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

26ms
25ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:388
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 4149235A-DCB5-46D1-9F1D-54ED5497E453
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 043C 43 B
840 B 106ms
34ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/4149235A-DCB5-46D1-9F1D-54ED5497E453?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=4149235A-DCB5-46D1-9F1D-54ED5497E453&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=4149235A-DCB5-46D1-9F1D-54ED5497E453&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-jBYIBFFE2uUXjYEyn8NWqJt4.06hKHM-~A&gdpr=0&gdpr_consent=

0
48 B

921ms
16ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-jBYIBFFE2uUXjYEyn8NWqJt4.06hKHM-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 29 Jul 2021 01:07:49 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-jBYIBFFE2uUXjYEyn8NWqJt4.06hKHM-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2370592322880373369&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
42 B

43ms
23ms

Image
text/plain

185.64.190.79
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.79 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug004:0:449
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 043C 0
104 B 115ms
62ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=4149235A-DCB5-46D1-9F1D-54ED5497E453&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:49 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H/1.1 200
OK CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 043C 0
88 B 7672ms
100ms Image
text/plain 52.55.122.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.122.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-122-95.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=64ec1f0d-f009-11eb-9a77-7d04c1b82951&gdpr=0&gdpr_consent=

1 B
234 B

264ms
28ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=64ec1f0d-f009-11eb-9a77-7d04c1b82951&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
cache-control: no-store, no-cache, private
x-lat: amspug004:0:463
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=64ec1f0d-f009-11eb-9a77-7d04c1b82951&gdpr=0&gdpr_consent=
Date: Thu, 29 Jul 2021 01:07:50 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 64ec1f0e-f009-11eb-9a77-7d04c1b82951

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=6e293443-ac92-4b8e-97d1-bc479d983834
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=6e293443-ac92-4b8e-97d1-bc479d983834
https://x.bidswitch.net/sync?dsp_id=4&user_id=ce2be16e-8bde-4b16-a85b-888c047307d9&ssp=pubmatic&expires=30&user_group=5&bsw_param=6e293443-ac92-4b8e-97d1-bc479d983834
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=6e293443-ac92-4b8e-97d1-bc479d983834&gdpr=&gdpr_consent=&gdpr_pd=

1 B
181 B

17ms
16ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=6e293443-ac92-4b8e-97d1-bc479d983834&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:49 GMT
cache-control: no-store, no-cache, private
x-lat: amspug001:0:479
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=6e293443-ac92-4b8e-97d1-bc479d983834&gdpr=&gdpr_consent=&gdpr_pd=
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=cc0cade3-b915-4caf-a108-0570cc092858-6101ff67-5553&gdpr=0&gdpr_consent=

42 B
231 B

24ms
24ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=cc0cade3-b915-4caf-a108-0570cc092858-6101ff67-5553&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:451
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=cc0cade3-b915-4caf-a108-0570cc092858-6101ff67-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 043C
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B341_E0F43F62_1F5E56B71&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

129ms
128ms

Image
image/gif

4.78.226.233
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

4.78.226.233 Dallas, United States, ASN3356 (LEVEL3, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-310507671; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
Cache-Control: no-cache
Expires: -1
Content-Length: 43
Strict-Transport-Security: max-age=-310507671; includeSubDomains
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: amspug009:0:393
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NaM_xGX0OcMu9D-RO_EiwmD3OMUu8WmQMaHolcVC

42 B
444 B

24ms
24ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NaM_xGX0OcMu9D-RO_EiwmD3OMUu8WmQMaHolcVC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:425
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=NaM_xGX0OcMu9D-RO_EiwmD3OMUu8WmQMaHolcVC
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_d2be8600-d7ce-4878-a613-2350fe668859

42 B
224 B

17ms
16ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_d2be8600-d7ce-4878-a613-2350fe668859
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: amspug014:0:412
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_d2be8600-d7ce-4878-a613-2350fe668859
date: Thu, 29 Jul 2021 01:07:51 GMT
p3p: CP="This is not a P3P policy"
server: nginx
timing-allow-origin: *
content-length: 0
content-language: en-US

GET pubmatic
sync.resetdigital.co/csync/ Frame 043C 0
0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 043C
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6349565183370189045

42 B
252 B

17ms
17ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6349565183370189045
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
x-lat: amspug020:0:410
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6349565183370189045
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame D1F3 31 KB
10 KB 24ms
24ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4c3c168a24456ee01b2b26429d88b9b9daf72f1c13c0de332f000750a9041450

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=12776
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:49 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Jul 2021 17:07:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84527
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9359
Expires: Fri, 30 Jul 2021 00:36:36 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame D1F3 284 B
536 B 340ms
23ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/jpg

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame B799
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
799 B

16ms
16ms

Script
text/html

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ee5130ff-68f7-4745-9c57-ff198538b96e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4d8e3c78-0d00-49ab-b82b-6895a4f874d5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame F476
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
799 B

16ms
16ms

Script
text/html

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 21e9c317-0e27-4cf7-8c97-2cd7f81fc177
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:50 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 138b3947-3348-4019-baa8-30692768947a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rochester.js Show response
go.ezodn.com/detroitchicago/ 3 KB
1 KB 12ms
11ms Script
application/javascript 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/rochester.js?gcb=195-1&cb=12
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd8f8e02bbd8e3500d048135ca8d238d0cafd8f3487d96ed7ad8390b856fc170

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3742586
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ejU5XCDLB4eNaXF3vQN2rkldDmDY2Yhp0rHWsFvwZ7%2F8oHVSZNw2aeILFwUwJXSkEyq0CJynyhmRk2U4%2BsHQF0Cv9MGRxYj1Fe45GS2RKKNnxAxIPcxtH9v2lHoJc3nkjOVaVOCwr%2FjOQGg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
cf-ray: 676273e2ecd24ee0-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-robots-tag: noindex

GET
H2 200 imp.gif Show response
g.ezoic.net/detroitchicago/ 43 B
259 B 26ms
26ms XHR
image/gif 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif?e=%7B%22ab_test_id%22%3A%22mod96%22%2C%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%221%2C21%2C3%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A4%2C%22bad_words_found%22%3Anull%2C%22city%22%3A%22Amsterdam%22%2C%22country%22%3A%22NL%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A0%2C%22domain_id%22%3A19471%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A11%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A4%2C%22metro_code%22%3A0%2C%22page_ad_positions%22%3A%221102%2C1104%2C1107%2C1108%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%226e3c9cde-bb30-4037-6858-97d9242fe6b0%22%2C%22position_selection_id%22%3A0%2C%22postal_code%22%3A%221012%22%2C%22pv_event_count%22%3A0%2C%22referring_domain%22%3A%22ranksays.com%22%2C%22response_size_orig%22%3A0%2C%22response_time_orig%22%3A0%2C%22serverid%22%3A%2218.184.219.30%3A18347%22%2C%22state%22%3A%22NH%22%2C%22sub_page_ad_positions%22%3A%221102%2C1104%2C1107%2C1108%22%2C%22t_epoch%22%3A1627520865%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp%22%2C%22user_id%22%3A0%2C%22visit_uuid%22%3A%222b64bf01-81f2-428f-4d52-221ec3558f97%22%2C%22word_count%22%3A421%2C%22worst_bad_word_level%22%3A0%2C%22cdn_browser_cache%22%3A0%7D
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: imp_sol
access-control-max-age: 1728000
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-headers: Content-Type
content-length: 47

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.ranksays.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 347ms
346ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=2710500254491670&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C20%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D3%26at%3Dbf%26adr%3D416%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D0%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D86%252C168%252C133%252C4%252C96%252C122%252C93%252C20%252C26%252C31%252C143%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%2C18%2C601%2C619%2C1428%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520870007%26ss38%3D1%26ss9%3D1&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627520871&dt=1627520871012&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=627&adys=1814&adks=3973230703&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=6&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddcc6d32c7526e8875e64b0dfb4a4317b30c13bd6eefa2605714a8ce52812a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10055
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 378ms
377ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=3372465094037763&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=iid1%3D7309279709745444%26eid%3D7309279709745444%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1107%26sap%3D1107%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D3%26at%3Dbf%26adr%3D416%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dranksays_com-medrectangle-1-7309279709745444%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D3%26ftsn%3D3%26br1%3D0%26br2%3D36%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D83%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%2C18%2C601%2C619%2C1428%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520870009%26ss38%3D1%26ss9%3D1&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627520871&dt=1627520871016&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=962&adys=1814&adks=383568383&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=1070&btvi=7&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca63bf8d337dbca81996d6ece16de1568bd3e58f46f0b6d6a77a921dddd0f872

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9828
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 401ms
400ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2148454575177760&correlator=38025575861296&output=ldjh&impl=fif&eid=31061423%2C31062052%2C21068030%2C31061425%2C31061843%2C20211866&vrg=2021072403&ptt=17&sc=1&sfv=1-0-38&ecs=20210729&iu_parts=1254144%2Cranksays_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=iid1%3D8683006199711509%26eid%3D8683006199711509%26t%3D134%26d%3D19471%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26a%3D%257C379%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod96%26ic%3D3%26at%3Dbf%26adr%3D416%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dranksays_com-box-4-8683006199711509%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10063%2C11304%26bv%3D0%26bvm%3D3%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D0%26br2%3D32%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D85%252C163%252C207%252C4%252C95%252C122%252C92%252C20%252C26%252C209%252C205%252C31%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C608%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%2C18%2C601%2C619%2C1428%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1627520870010%26ss38%3D1%26ss9%3D1&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627520871&dt=1627520871022&dlt=1627520865516&idt=594&frm=20&biw=1600&bih=1200&oid=3&adxs=815&adys=926&adks=130617237&ucis=c&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.ranksays.com%2Fsiteinfo%2Fshitkingz.jp&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=510x0&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1508606417.1627520866&ga_sid=1627520866&ga_hid=61304881&ga_fc=false&fws=4&ohw=510&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a2a4af0d0ce0d13aae4a29199a5f85c876f414a976f13165b5705d189598694

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9891
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ranksays.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 93BD 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 29 Jul 2021 01:07:46 GMT
expires: Fri, 29 Jul 2022 01:07:46 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
66 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzA5Mjc5NzA5NzQ1NDQ0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTEtMF8xIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDA3LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0NjEwNTg0MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ4MTc3MzU0MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 4817735420 Show response
g.ezoic.net/dac/ 0
17 B 26ms
25ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4817735420
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA3LTI5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImF1Y3Rpb25fZXBvY2giOjE2Mjc1MjA4NzEsImFkX3Bvc2l0aW9uIjoxMTA3LCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiYmlkX2Zsb29yX2luaXRpYWwiOjcwLCJiaWRfZmxvb3JfcHJldiI6NzAsImJpZF9mbG9vcl9maWxsZWQiOjAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM2MywibXVsdGlfYWRfdW5pdCI6MSwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo0ODE3NzM1NDIwfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 34ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

727d06f38b813004baa0b6a9c96c24e2bce04b7be4c05f9486499f4250f9a772

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627298829912756"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27995
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:51 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3CE3 624 B
400 B 15ms
15ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNVzGTfh4JDG3IZBD087abKVAkfR0BLtzd4xomyUJONG6SfKDYR8Xqi_8NZSEBKPvWrix-TIViKUXW-e94Lp1Sja58JyEwkgchddOB933r0FIU6lxkevNBC2GDdbbEFP2oQynnM7Y6jv3mA9T-akt-1svXnYkloL623pxlPrSukPkTACEBCuZzodd8yWLBL39xxcRrmHg3BXYHoNknrfldjHsbtRkg

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNVzGTfh4JDG3IZBD087abKVAkfR0BLtzd4xomyUJONG6SfKDYR8Xqi_8NZSEBKPvWrix-TIViKUXW-e94Lp1Sja58JyEwkgchddOB933r0FIU6lxkevNBC2GDdbbEFP2oQynnM7Y6jv3mA9T-akt-1svXnYkloL623pxlPrSukPkTACEBCuZzodd8yWLBL39xxcRrmHg3BXYHoNknrfldjHsbtRkg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm7Ys3tgK11p7R7-ty0rFkqUrBVI1jBAB7zOKR0CX6v7KKxD5x5oNgV55e834I
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 29 Jul 2021 01:07:51 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 93BD 24 KB
13 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AV3ivGSFUaIkMCAoaAl1mAuun3WBvive_t2ALHrhBw7-UXK-qpRAhTpnJGQ9O_bwrExWRL2bIUPGExQ7Em0Uq1ovfRA-BNNiFDsDr48v6JjP1cg9-s8s5IJNSBjnQig7gSixIeNcGZ8ZNtxTpQ6yKjFv5SGw&cry=1&dbm_d=AKAmf-DXC1FL_28h8nk_zfJBH6yjAIbsMN8rAZmLisiqqEOoXStzNnUU979-swsRSjaj_wyerIQee2d45xl0LoDLuM-Ot7N5LxQdr3EysOayXIwKXGmp7AAizRWc22NrS0lX85fIeoxx34tvctEdQOkStYTbqrMosDqCpEOs-W9_1Hg8Ag3lLIdANZC3S0JHQLl-DoA8k8yBSKtgIfl1cB6W8NUIfo1wEa1eQdEwgOfNPR4dqIwgTMLbR1Gc5ZqTWT1Z_3L3iAdLYXBlaz3esbvRxnxCbkqWGS6A6PrpLXRa2qBNstBWwRLGqbm7qUx2-z-CnbhAclkWU73B0E7Qe4ROX-X26vqLS-AFv4d5-EGh3wKYcFSWOsDnun7v2QBU0aEzmgIJZHSDquhTmfjunoY7vakiKjibpJnBKWBUXH5ILCd5hMyLFF6ERqv3TOYsL742unvmNSjTxQznwMWatd8vBbX1QvDCL5mfH31lkBuHHUblpx-IHrtC_JerAPVsJnGTp6vey-ozHuOIlImb3flTHKTT0IBkfI62_eE_cB3xei2ZHWtCtQ1UAahePnrbgmtiykUmo6aESObtpk4ha8PEqnTEpcA4RNB0FU2f39JV9BWf8kaPH9rnUh5_E0sp4eKDncW7tLUl-I39NrJwJW32REAXIGHEwZPzHuR3f33RA71CXt3fq0dslkozen2OobNAar6nbV_xM8lg2rDzEP8HB7RqsjDbrU17OHbBPXs03n7b2lFYEekYxYGqWlH8s1FkkuWKIjl5JWoF_i6s4f5pXkH8loP-pPlBokd2qdjBEQWz0OixQ0xnjhRO3jmVncv4qMhEskrNv95j2Ko1z2q_a8-oDvqXyCD5YMB-jlaJvDuL1kohWEW_D8OEQe5LNjhiZj_O5tgCpYvp4C11ShljJ0TfHDRy18FFIjbP7_ySRt7R52wTLbzMtMZlTZhQ3Q-FuxuAetC0vcPfRKlA_keBRBbSdX1dq2Yg9XkKUxYRJyrv_8KQKVubUML7u4fdLn5s_dGRVi2jscR0eChekYA-W-NzzWbLXJ66xo_ApoSpfDGzAPfVCbcMiqOdMHxdIyfqdhYcAMGloC3qEsDOa3RXwWk3WWtE94Iy2tHFu1A9MNBzwlYBXNudeTLAO7PVrtiCAykhvETNuBBIkWjVO32CgRcqAW4BQ82LlKFhOqElWZpnF9hGrZDGAqlDxEOnHszCW1C2nBqNTNAd7OhofTNNc4YNHFkKgu3nSeInKE2YDkPKv04AlTBfE3-z67x2AicKIur6-RxKND67OFBUxvNKMCU0bBzbUybuyFf3qC3DSmpV2vU2p7PYnQqLwykXNvDkVrU2cj4VU5QvssxCtBY8Ui6ylklMSccJTBQ6jKJCwg0om_srQJyMG_JsyMGY327RgPnPYMrUquhJfW9U1hyTToyevnlvhVyu0GYQEv5oloPBcPBQQ0dDwVTfrJdIFGlgZG3Y55Hf7kDFk4eiLBiZFibk-7XrqbTXiLbp7LrHt50xmmLz4VzOy2Of8EfkpcSae0Pd4iuQXrF1iVdyjHLGWWMybXIUHpMNKomfqEKLI_g3JmvIfOPfc0N-cSKn-xK-EwE7bcMiZpA-a1juLfLvpckl_5cENPTPHw60PUVNRU2FxGaklHDj2EfH8BV_MVXn7d0W1X_imLtuZJIhm6p3fmp1L0qpk6HR_Pva2HhrcNSulRy6H77o0pc95kj8ZT8ZXlnEUr6q6XG6ycH9MpOeXmj21URaCm3JdS58RDdyNlTaIYiprXDb0ilKvkhs4iERlBhtMBRvTb4dt63h3EtHw12vYGgjje0Uk4MYT8txDKPjKRSbtGhyYFVZOjQN9pTLwgtoemfT7idMOy2SA5FMir8VkYecDt9goFcmWEftEaOh5ci-0Y-nePwOZGcrIiELnYHjrfAx7PdVYN8VphMzFOJQzMU7hkimiMPLc5lPKmhFbr0zq6KBeXR6DhRgi-_RD4nYDDu0w-32JFPHMgAXuBA60TTb6XIc198c7hzyosUdJYGI05sCH_gzwRaFR6zxpXyRbH6wLQLxpIhuoDNNJhyBGmQwdpcjBgGpv4m20D2_oYLJvQUKUfY9wxylNc6Tmkb_90h1qWXisHQHKTPqw5DRh2U1IGY3N9Cdw4AD0KQi8VPDKq1V_PfNfNhNrOsD4OcMP42_Ag5AYEtUTKN_OD8c5omCOsptnB5zvqRtlg1BPFvaEMqown5UZ8dNCkAbSQkO5RMhDPRVi3E463IPT_8naLGlC8xNO20fxxoiYSci7ITK8spd9pvmfKPgkcVCFWuAmDSFTu_1DrwN8KTdBERmlYF7cWSQB3qvxsd7ZWtFWMD8jqt4ZBlATx9kfAVr0z6bM2ilBs_w0NU7b_UVoGEFIMU31vXMnqOyiX-JNxVLE3-sUgKaEdwttLq73VuPyfnIf-V8tlp1wBglI32jXZ7_hRLCBpRKHef17tmiVE3WuucKa11O-fC-5K1rELMLijcJBRBoc8UPP_L5GjHOl3_fLlbwqwruPfikTzSZbfLxfBEMCBKjLQiN3tCsuhiZw3YYnbyUk_JxkWKRpT2worLUWfyzjiNXHtgNLHmWz691Mi209dOmiV7ES_LhG5eiRcy_vAVKRGOgQRIiM_apD2siAQ46OPH9VnuL8F8CHDFEvvPpfhIP6Azn2uxrPU1vhMT-tOemoF4bP6SJiKbk5IDxjKYVDYOedBlypJ-E1HwG6kaGr89q6_yczYiLnpRG3-PI1cYe0HUJcbLc9pK4pwCdrphjl33M_UHHDvL9EHpIaL3vCUWdKpEpwny8tQ4HGZSvRNEHO4V3kdnstSJuxtvz1s1X_GTDfxi8OVzVqpL5RINBX0tfUSjYK0I35iLLxwKzKGHyCaGbus55e2NWVfOsCfRFPOJ8ub1wzQpdNMw22AdpvwsLWfaMRbOVGeRV3QYyNyv6gi_mbZAMG8CEF2dSdl5eRbn44Vsyem66TeIMvllyecCXsLfbXqaQIsSZQDLEytp9hH_zLSJQIno7SzpKfHCfs2jdbNLgZ88TmtD1VwIJYkdbCdKiaP8PlawejmogUtwB0CUGNaWP4dLMEHHujyK791I-6jkl9UzbAwRgEzfCqCJtvTLLxZeWdT5-IviJ7bMdCqO8JNdL0CQCWdEP6Ar3QQsCzqiNCxCWgJXbZO7kWxFJnSonGrC_gKnAMqBHqovbk-ws4tRcnVgWn9v6vwPqgnE64txXvglHr2MwA3uWGR0&cid=CAASEuRokQ38ZjzMIcTwAw-TI64vlg&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03cce7c3685501dcd7e8cb8a44623560753c1b3d3776687bb37f8cf24f915230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12893
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 93BD 42 B
515 B 57ms
39ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AOjesNRXY96L5jZDPf-jpZaNTexka_2GA_AU6reltC_q5H4_kGH8wBzsHsVkB_Qf4HlN_auQTycTPXPPmkiC8W0VrX0kKO-PrLMKh9AsHPB67bLUo

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame 93BD 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:04:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 207
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 01:04:24 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame 93BD 14 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 00:59:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 487
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 00:59:44 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 93BD 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTWJ4mzbBsv7VEsOvW8AUbM19A1MHONjbCvHdDjVQiv7e0KodMnTg6l-82Fuv9IpGhNxI09m7O1EzVVK9y9pvC8PZrcag
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 93BD 124 KB
37 KB 27ms
18ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ee596b76772ac1263c57b05c3d05329db5e875cbcec8e917047b5d221fbb1c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627298817379074"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38160
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:51 GMT

GET
H3-29 200 container.html Show response
cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B236 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 29 Jul 2021 01:07:46 GMT
expires: Fri, 29 Jul 2022 01:07:46 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MzA5Mjc5NzA5NzQ1NDQ0IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tbWVkcmVjdGFuZ2xlLTEtMF8yIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwNywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDA3LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzgyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjcxNjE0Mzk0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 71614394 Show response
g.ezoic.net/dac/ 0
17 B 26ms
26ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/71614394
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA3LTI5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 31ms
30ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImF1Y3Rpb25fZXBvY2giOjE2Mjc1MjA4NzEsImFkX3Bvc2l0aW9uIjoxMTA3LCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiYmlkX2Zsb29yX2luaXRpYWwiOjcwLCJiaWRfZmxvb3JfcHJldiI6NzAsImJpZF9mbG9vcl9maWxsZWQiOjAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM5OCwibXVsdGlfYWRfdW5pdCI6MiwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo3MTYxNDM5NH1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3CE3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1&C=1

43 B
1014 B

29ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNVzGTfh4JDG3IZBD087abKVAkfR0BLtzd4xomyUJONG6SfKDYR8Xqi_8NZSEBKPvWrix-TIViKUXW-e94Lp1Sja58JyEwkgchddOB933r0FIU6lxkevNBC2GDdbbEFP2oQynnM7Y6jv3mA9T-akt-1svXnYkloL623pxlPrSukPkTACEBCuZzodd8yWLBL39xxcRrmHg3BXYHoNknrfldjHsbtRkg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 29 Jul 2021 01:07:51 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Thu, 29 Jul 2021 01:07:51 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3CE3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YQH-Z4pLKdVVodBN4vXROQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1

43 B
894 B

29ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNVzGTfh4JDG3IZBD087abKVAkfR0BLtzd4xomyUJONG6SfKDYR8Xqi_8NZSEBKPvWrix-TIViKUXW-e94Lp1Sja58JyEwkgchddOB933r0FIU6lxkevNBC2GDdbbEFP2oQynnM7Y6jv3mA9T-akt-1svXnYkloL623pxlPrSukPkTACEBCuZzodd8yWLBL39xxcRrmHg3BXYHoNknrfldjHsbtRkg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 29 Jul 2021 01:07:51 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENy0jBxEPsBxnVanzNmw-s8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3CE3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENoGnP_OfmnZIfRKe7-X3QU&google_cver=1

43 B
1000 B

18ms
16ms

Image
image/gif

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENoGnP_OfmnZIfRKe7-X3QU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNVzGTfh4JDG3IZBD087abKVAkfR0BLtzd4xomyUJONG6SfKDYR8Xqi_8NZSEBKPvWrix-TIViKUXW-e94Lp1Sja58JyEwkgchddOB933r0FIU6lxkevNBC2GDdbbEFP2oQynnM7Y6jv3mA9T-akt-1svXnYkloL623pxlPrSukPkTACEBCuZzodd8yWLBL39xxcRrmHg3BXYHoNknrfldjHsbtRkg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e4fe416f-6aa0-4ba1-848d-6f78d706874c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENoGnP_OfmnZIfRKe7-X3QU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3CE3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjE2OTczMzQ2Nzc2Nzk1NTI5OQ%3D%3D

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjE2OTczMzQ2Nzc2Nzk1NTI5OQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
X-Proxy-Origin: 159.48.55.7; 159.48.55.7; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9e3f4784-29e4-455e-8b1e-fac959a4a25f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjE2OTczMzQ2Nzc2Nzk1NTI5OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/ Frame 93BD 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AV3ivGSFUaIkMCAoaAl1mAuun3WBvive_t2ALHrhBw7-UXK-qpRAhTpnJGQ9O_bwrExWRL2bIUPGExQ7Em0Uq1ovfRA-BNNiFDsDr48v6JjP1cg9-s8s5IJNSBjnQig7gSixIeNcGZ8ZNtxTpQ6yKjFv5SGw&cry=1&dbm_d=AKAmf-DXC1FL_28h8nk_zfJBH6yjAIbsMN8rAZmLisiqqEOoXStzNnUU979-swsRSjaj_wyerIQee2d45xl0LoDLuM-Ot7N5LxQdr3EysOayXIwKXGmp7AAizRWc22NrS0lX85fIeoxx34tvctEdQOkStYTbqrMosDqCpEOs-W9_1Hg8Ag3lLIdANZC3S0JHQLl-DoA8k8yBSKtgIfl1cB6W8NUIfo1wEa1eQdEwgOfNPR4dqIwgTMLbR1Gc5ZqTWT1Z_3L3iAdLYXBlaz3esbvRxnxCbkqWGS6A6PrpLXRa2qBNstBWwRLGqbm7qUx2-z-CnbhAclkWU73B0E7Qe4ROX-X26vqLS-AFv4d5-EGh3wKYcFSWOsDnun7v2QBU0aEzmgIJZHSDquhTmfjunoY7vakiKjibpJnBKWBUXH5ILCd5hMyLFF6ERqv3TOYsL742unvmNSjTxQznwMWatd8vBbX1QvDCL5mfH31lkBuHHUblpx-IHrtC_JerAPVsJnGTp6vey-ozHuOIlImb3flTHKTT0IBkfI62_eE_cB3xei2ZHWtCtQ1UAahePnrbgmtiykUmo6aESObtpk4ha8PEqnTEpcA4RNB0FU2f39JV9BWf8kaPH9rnUh5_E0sp4eKDncW7tLUl-I39NrJwJW32REAXIGHEwZPzHuR3f33RA71CXt3fq0dslkozen2OobNAar6nbV_xM8lg2rDzEP8HB7RqsjDbrU17OHbBPXs03n7b2lFYEekYxYGqWlH8s1FkkuWKIjl5JWoF_i6s4f5pXkH8loP-pPlBokd2qdjBEQWz0OixQ0xnjhRO3jmVncv4qMhEskrNv95j2Ko1z2q_a8-oDvqXyCD5YMB-jlaJvDuL1kohWEW_D8OEQe5LNjhiZj_O5tgCpYvp4C11ShljJ0TfHDRy18FFIjbP7_ySRt7R52wTLbzMtMZlTZhQ3Q-FuxuAetC0vcPfRKlA_keBRBbSdX1dq2Yg9XkKUxYRJyrv_8KQKVubUML7u4fdLn5s_dGRVi2jscR0eChekYA-W-NzzWbLXJ66xo_ApoSpfDGzAPfVCbcMiqOdMHxdIyfqdhYcAMGloC3qEsDOa3RXwWk3WWtE94Iy2tHFu1A9MNBzwlYBXNudeTLAO7PVrtiCAykhvETNuBBIkWjVO32CgRcqAW4BQ82LlKFhOqElWZpnF9hGrZDGAqlDxEOnHszCW1C2nBqNTNAd7OhofTNNc4YNHFkKgu3nSeInKE2YDkPKv04AlTBfE3-z67x2AicKIur6-RxKND67OFBUxvNKMCU0bBzbUybuyFf3qC3DSmpV2vU2p7PYnQqLwykXNvDkVrU2cj4VU5QvssxCtBY8Ui6ylklMSccJTBQ6jKJCwg0om_srQJyMG_JsyMGY327RgPnPYMrUquhJfW9U1hyTToyevnlvhVyu0GYQEv5oloPBcPBQQ0dDwVTfrJdIFGlgZG3Y55Hf7kDFk4eiLBiZFibk-7XrqbTXiLbp7LrHt50xmmLz4VzOy2Of8EfkpcSae0Pd4iuQXrF1iVdyjHLGWWMybXIUHpMNKomfqEKLI_g3JmvIfOPfc0N-cSKn-xK-EwE7bcMiZpA-a1juLfLvpckl_5cENPTPHw60PUVNRU2FxGaklHDj2EfH8BV_MVXn7d0W1X_imLtuZJIhm6p3fmp1L0qpk6HR_Pva2HhrcNSulRy6H77o0pc95kj8ZT8ZXlnEUr6q6XG6ycH9MpOeXmj21URaCm3JdS58RDdyNlTaIYiprXDb0ilKvkhs4iERlBhtMBRvTb4dt63h3EtHw12vYGgjje0Uk4MYT8txDKPjKRSbtGhyYFVZOjQN9pTLwgtoemfT7idMOy2SA5FMir8VkYecDt9goFcmWEftEaOh5ci-0Y-nePwOZGcrIiELnYHjrfAx7PdVYN8VphMzFOJQzMU7hkimiMPLc5lPKmhFbr0zq6KBeXR6DhRgi-_RD4nYDDu0w-32JFPHMgAXuBA60TTb6XIc198c7hzyosUdJYGI05sCH_gzwRaFR6zxpXyRbH6wLQLxpIhuoDNNJhyBGmQwdpcjBgGpv4m20D2_oYLJvQUKUfY9wxylNc6Tmkb_90h1qWXisHQHKTPqw5DRh2U1IGY3N9Cdw4AD0KQi8VPDKq1V_PfNfNhNrOsD4OcMP42_Ag5AYEtUTKN_OD8c5omCOsptnB5zvqRtlg1BPFvaEMqown5UZ8dNCkAbSQkO5RMhDPRVi3E463IPT_8naLGlC8xNO20fxxoiYSci7ITK8spd9pvmfKPgkcVCFWuAmDSFTu_1DrwN8KTdBERmlYF7cWSQB3qvxsd7ZWtFWMD8jqt4ZBlATx9kfAVr0z6bM2ilBs_w0NU7b_UVoGEFIMU31vXMnqOyiX-JNxVLE3-sUgKaEdwttLq73VuPyfnIf-V8tlp1wBglI32jXZ7_hRLCBpRKHef17tmiVE3WuucKa11O-fC-5K1rELMLijcJBRBoc8UPP_L5GjHOl3_fLlbwqwruPfikTzSZbfLxfBEMCBKjLQiN3tCsuhiZw3YYnbyUk_JxkWKRpT2worLUWfyzjiNXHtgNLHmWz691Mi209dOmiV7ES_LhG5eiRcy_vAVKRGOgQRIiM_apD2siAQ46OPH9VnuL8F8CHDFEvvPpfhIP6Azn2uxrPU1vhMT-tOemoF4bP6SJiKbk5IDxjKYVDYOedBlypJ-E1HwG6kaGr89q6_yczYiLnpRG3-PI1cYe0HUJcbLc9pK4pwCdrphjl33M_UHHDvL9EHpIaL3vCUWdKpEpwny8tQ4HGZSvRNEHO4V3kdnstSJuxtvz1s1X_GTDfxi8OVzVqpL5RINBX0tfUSjYK0I35iLLxwKzKGHyCaGbus55e2NWVfOsCfRFPOJ8ub1wzQpdNMw22AdpvwsLWfaMRbOVGeRV3QYyNyv6gi_mbZAMG8CEF2dSdl5eRbn44Vsyem66TeIMvllyecCXsLfbXqaQIsSZQDLEytp9hH_zLSJQIno7SzpKfHCfs2jdbNLgZ88TmtD1VwIJYkdbCdKiaP8PlawejmogUtwB0CUGNaWP4dLMEHHujyK791I-6jkl9UzbAwRgEzfCqCJtvTLLxZeWdT5-IviJ7bMdCqO8JNdL0CQCWdEP6Ar3QQsCzqiNCxCWgJXbZO7kWxFJnSonGrC_gKnAMqBHqovbk-ws4tRcnVgWn9v6vwPqgnE64txXvglHr2MwA3uWGR0&cid=CAASEuRokQ38ZjzMIcTwAw-TI64vlg&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:05:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 01:05:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 93BD 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 15:17:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 15:17:35 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BEDA 640 B
316 B 18ms
15ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm7Ys3tgK11p7R7-ty0rFkqUrBVI1jBAB7zOKR0CX6v7KKxD5x5oNgV55e834I
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 29 Jul 2021 01:07:51 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B236 24 KB
13 KB 39ms
37ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CT6SNVGt3ZrVxfy4bTceBTtX8MtoqQarCzaQSys9c8tro3fisY-XILPEnLVworqDtjHes-u4w0WOQ-K5SfYhH_kz6uXgLS-Vaj0wsApznYUf3fmVfSD6UiGMoaQnF8RbgEinWpHUXlk-F11iQf4wSM9m-S9Q&cry=1&dbm_d=AKAmf-AgwocuAHRJQpzp8knZ4BC-d_roiHoHkgYd7IEmUtKZoNFLdyuhkg5NBIidH-TaXSBldGl_KYHDuQvZb9UmlYwh_e41ITPRRpopxM1rVUS9pWsHKxfBYqYcEe3xLIJU5dF0yHJnKbM0QVrYVr5_wjcXCVQX0C9luKqNIrEECBfJLIDuCd1zxZ8e6OZCnsE_f06toePWDtXv0Ih71FdkwGFeGqRg7d704tEa0-jYJAq9VTdaoUJZR17MJZ7_ptsnIwabxjwCZacOqIjaTvwgY2g0w0QIyX4I0gswN7dw73FDRPhpf-JoUSug69BD6cWKSj8y28K1wT605yXPTLP2JfS4wcu5KZB_1I7kk3uYlKyKd2uGR5i0m1dVdSKLOR00Wa5TEmt_zrVngb-9jd6_60R81UO7l1qOfdbs3Z8xRwZaq1af8isRRvMVhoZFxylDwmH0qRBwLHakL_8EznizBAS4Dl5w-HRZw6APKvYLTUFXJ9ylSAeryT4jGorjLUSeQdOk57KG8FQkF16DGIMpakRJMX8n0BbUAIKAC_zwwJt0GLeJp4QOy5I5OeQKUma4ukebjFwp78m1oKaxKkhvjg-SIE4zuf6nWNxZASiGHZCh7vY8MGwG_g-d4vDfkVt_thFaj99PKAeilgm6G1JVXfiC9gTupZAikbJc78Eg7zRHriNTd5YkH8sVoaalw9enUXR64_KOBit1NYvYFrljKl2hJjm64SuHCKX2vjJa0mcBV9R8LIjznDVAbhZBU5QQ_qdnXzaikzvq-vh8MHvF3X153tdBZycU5s5eOnhm8y_qGKKi4dLt048v1O-JkRSTu-g9qcbRGyjQLVOdUOiP_GZHVrQ3TRbzk98OwNobLVRyvOGWC-i0UxDqrG13KOFFfVzqpzdFB2vlejI0_q5V7cdJdx7BKUOYUCtt8Iw4CDR29tNqark6nq95E0JRzPc6TSkWMpUQUA_BLdQRbsVDFFZnu1mGSWuwxcc9AqxiX_NMAWt3e2J7z--4kHaIB7R-bMbNcTnX5nRCwlLqXy6eefAUunAW2NWP6euBZ93tmlQKTNrVQphQyHSCYWOgbo3vTU9haQqFR0hjTFSTtpZzUngYu3F1d-a-IPwuCUhCynRsZWN1FECWAZoubEwNeUXGm912CoOsYURCP4ZpaauPjPm8J-Yb6eKRhICxnPnCLqNDHb1FxKEcdLM3qzRjl4XmtA6RxwuR9b4Bsv4qTmZ1JRWGDSsa8C55fyirEwzq7mgUMDhg_0Ka2TsTDZWMd8iuXS_hvd6j25wEVz2XqXKt4f3TaxlN9jXnhsOkO56jyuc9lO2hipM5Ad0lXvh1z9cDpnLBhAqwDCm1enK4BQlDkKnduMhpUjMA-GUz8fRLe7U0hu-LC1lpVN4OTuku5sz_mLWHfF0-m0AmPvUYxyj6dO_240g7nqJggXbLZSwynIp4rCsk9jIvJn8YKub2BsjHmusGa7pjTszcFtnIZ_mAKBGk4nfqHw2LBuiqeUtvCyi4l1oaFhAziWAhxxBiYbOIEQv8YyHD3GmnWr8QQdQF9maL4o1ItwgaLDigG748Q5KumrRDlewb-ohcZEs1sAOWTGdacZwJKNxJsbXRssGIG-ibw90TOGvNq-QMjEiiXgJGlOLDiKlIAcksXWzKpycynnZBkiI5t4tACd2EkDSXu3mJLsSi379euaEDvIpKp-l9Xm2gjt9rpoBfHWdVV2q-U487I98c_xe6ceNHiuIuWqW09i9NNu7rRwDbKXtKEJG50PLWzFMHosWbbnQMy8P9so4FrSK-E_iuE13XSej0DscM9CbZB8kAio-7okQCJ4jkCJg3E6kBXJCfH1TD8tWU23C1UR736hEl6rpjp6CGVmyDwV0arSBf2r2Pwq14rekxa-0I_7SeVGk6ux0yfPHzrD41b-qdWTgwjEqx6n-PfOv81G1IDRaK7L_hTmjXFa9zgGJ97wEvIjXUtWkutxHUhk1s6UAD4BTotHYe1_K-q6qdaxr4AvoFTprOtAf-tyYaQPOgn3X8ApyHK9P6L0CbMYVKcd2No3uuDWc6M49VLJ5JmajaTgzji1ZpB4T46NbpNdencCoY4SjCA_2UkKEdXxKOepDuFintMxaX_-mSqkmGBDr5w8qxyxjwJJVdo6MMLD2uexLvWFNPtkwVEL5zBKt7O9syV25G3bYOyQ5MIWTzJCJ3IKXXBbfJYLI7nkxBFV2q8hOR0q-kg23CvBDtrwrWDrlDCNHOSYtRkpOTfwL2DwZok9y9txdh8anPhWtCMKMg_i1-Dvwn68UG9xsnCQNI4ZbIMZdXNqt6rPbbEh9yStdASnLNqFABJ5tghw32t5C-SxrHFsnJcMVr2JDnWS5g-614C_NcRMStNUullWuZJ3EKUz2cAWco7T3x2u2d833KiU8vv3NYw-7i6c390Jw0Hir0UvRayVL8CQPHd9ZKBr64ukn41AiNnspK38pXJBDTZACgoC7VOtKnYpTcffBH5lpU1MmTNfCt-9nFEV30gTpztp-rVeHDvnSZByCtP605-IrA9FMTV1ggdKA33XelPv34Jyxhp2rv_lqj2exMVwWRoJBiiZT33TiSe319WPdKL6-B_Sazy4hfv0M9lJBwBuk4hQWZblWj2p5MrnDGRsih-oCQxDD3YQR4X6vKTBei5BVO2wMrQ0Xgg50au9B0vR51Jm6FkxeFVhjbBnAMxSwLusiH2rRd7A72PyCVE1ma59vz5YH10Uikhl5aaLLOun0POfJqfCEsc6ZS7cl5daqc4L2JH49VDydlTi9pF4U7aP4V4i4yEfctXuuGmVZBn22fmg_4UEOKJhSIhOL9DEh9GLSHeRWs5Cenw_U7iQ3cCTEl2gfpjCuJnI-PnTPSnavHyff9dCtEagqIz6KeXrJSe0mcX-uyRdaz1lMLjbDmInvN3T3uGyQnFEY6LHbUYoZlJngvxNBCO4sXTwAN0YzCI0o9IMyEWsvvtQ8PVa5Qzm38AMGSprTIq-Q7TpcVIceQjiPQKaG0xJTQBfRFMKejIjjDkE-O1Ve2XQE_VeUU15yQl22OUJVNaKIHl2IYDieH1ZV2cXK8wn9-PsBC_F6PmX93gDil7ZSPF__Hi5jK14pX7R8NRYKVvE4HtynVsYAlEXz_3LlkXZ63s-yogVJ71aLhe4raSwfznjkGyATEFIU_kzG9tIy4NaJHhRbFYImwYsJZHNFUIMREda4aFeoLT05YYiFD-5GamxzeSiG_-Ek&cid=CAASEuRoR2tLErkIVeyGs7h0dkeeZw&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

771cf49e4939f4f5ddde3117ec3ee05c68a91cefcca9082730b1d3747339c8a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12940
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B236 42 B
63 B 41ms
39ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BnOLFde2oLYgd54je2fXpjMqa7ASBFe1UtYN_05d0EsW5rRTnFXvsdofR5cczXsAH37Qxf4QajBjsAQvrd5qtp45Ci5bW9YMrj8tmsZv6uEXo8xfI

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame B236 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 00:00:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4014
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 00:00:57 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame B236 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 00:45:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 00:45:36 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame B236 0
0 16ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSoWFhX9pSwAQvbgMpaHbk-w6clDVCu6OyL9Z4vEn7nLy2bLxhqyqyoqn3lI6xI9wa_n8F5D00cNm9GYXuwwhasWA2NMg
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B236 124 KB
37 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ee596b76772ac1263c57b05c3d05329db5e875cbcec8e917047b5d221fbb1c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627298817379074"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38160
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:51 GMT

GET
H3-29 200 container.html Show response
cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 00FA 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072403.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ranksays.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ranksays.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 29 Jul 2021 01:07:46 GMT
expires: Fri, 29 Jul 2022 01:07:46 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 26ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODY4MzAwNjE5OTcxMTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg2ODMwMDYxOTk3MTE1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Inplcm8ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg2ODMwMDYxOTk3MTE1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDA3LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIwLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODY4MzAwNjE5OTcxMTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIwLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM4MjAifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg2ODMwMDYxOTk3MTE1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNzE2MTQzOTQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 71614394 Show response
g.ezoic.net/dac/ 0
17 B 26ms
25ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/71614394
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-1&bv=40&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODY4MzAwNjE5OTcxMTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNy0yOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNCJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
43 B 25ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODY4MzAwNjE5OTcxMTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhdWN0aW9uX2Vwb2NoIjoxNjI3NTIwODcxLCJhZF9wb3NpdGlvbiI6MTEwNCwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImJpZF9mbG9vcl9pbml0aWFsIjo3MCwiYmlkX2Zsb29yX3ByZXYiOjcwLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0NDIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NzE2MTQzOTR9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:49 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjExODU0MTk3MTY4OTc3NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI4MDAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjM1MyJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczOTk3Njk0MTU3MTk1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMjc1In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI2NTYifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4NjgzMDA2MTk5NzExNTA5IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tYm94LTQtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjgxNSJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTE2OCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjczMDkyNzk3MDk3NDU0NDQiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiNDY1In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxODE0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY1MCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjA1NiJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 25ms
23ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6Ijk4NSJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjA1NiJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3085 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 26 Jul 2021 15:17:48 GMT
expires: Tue, 26 Jul 2022 15:17:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 208203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK mu72dqmlk6df Show response
hal9000.redintelligence.net/zone/ Frame 93BD 11 KB
4 KB 86ms
29ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/mu72dqmlk6df?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1VOgZ_8BYYLLA9fU7_UPnqax4A7isNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Q9Le486AgMy3LQ_4sOSXlzAMxG7uIfSmUKos1SC7hpgJZTwgSfJKTrVWRXGfqAiuAwHMxaIhDunGbgFAwy2db1lWIsAZJ6cKsmJXpS5RnsVJRH3qxQkdmzS2qRppWyTJNXNJp6LR2M-_2GZMv4aaFZTeNhJiGGaz9Ybh1KJreSqsGPGA0jI1jYLTBGICDShWxyxXDQkigpApBQ678EnmLQvbqoAOZfiNmFmOLCwCugbjMolgnyGxBZlJXkqrOkNzKjSU7qKclWYN7FuPvwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRokQ38ZjzMIcTwAw-TI64vlg%26sig%3DAOD64_0qMqBWafjk-aMYwJesiTd-lU8RHQ%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-D7g7YRBKNyo_kKXbgt3QIw-g8zDTZhDezH-FLHYp4pmVMY0sT0vBWgsUMKZd5Xtw9IdKtJwKpqY2uxugx_fMXw7VnHRZN3E7ZSLdeABXlGFMt3t_Y132OwyMlDXLCXCLe88oyfzup10JgKIAQ5QXUIHx2HQw%26cry%3D1%26dbm_d%3DAKAmf-DVbNFjcPLf48Qlm7Vrykxqa92_7Lcz5C59jmAYUQU7k7JL7P1oGHxnsQsUqKByULhlVImKkr2mv7_QPC8C4hNhWqgZn_KOFzxUkHsWU1DSoF-g4h9FRsFDHJ5kU7r8trbqDOeoB2bQEQ_bqpgANxqeuzAV8mX_DUDWM_MTSO9TkNaJJjIjcJaA6aFMH-gmAr2z5T9wC6OikkwYW6ZpjRD1Mr4DeQnDCLwv1nmhUqxAToQLsUOrnkxyX6GfU8TlynsS2yjlDz0bZbGBeAAJ4wgr0BYaQJpPAXKhHUt_j78_Z-8tfTkKViq4TPIAP7QNN2CrEEe4aHswr7E5PVueyQGq2YGHvLYRQ02ClVtvC-Ogou1lB5rV2Z4QEkOBTjfzvpCAgYuquAN4HsReBJVLAnjSdduBN5AkI_Gbgk33W0LNLEW118jcU77e5CkcbiRpfCyiXWHB7a-Rbn5Hb1IXM8zfEXHsfQ%26adurl%3D
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: ce7b817dcb741aca835b16df19180d7e0cd47041cec393b3030df586f3ec2f1b

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:51 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3931
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2D12 499 B
334 B 20ms
17ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYpsvZlQEwAQ&v=APEucNXnrxBwEIi8FfXlN5IzbB5mA7U_lCVj9DTPkm4_r8RohpomZCMMe7C_-4a4Rh18MJl_Lxr6gCgxBUR_VoDpDZZrTBkYsu976K_32KqYnel9sb2HYHK2V4tP9VYkaNcFzrV5pPtYviK86sGJ96z4TVcx4PWxBjk5jVacUuujP7nlO65WxiqftNZjx7-M0GQL7cXbHkuuU_YGwWXDW3p0yu1KGj-gvA

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

583eda12fed77c078f7391866e53eedd80aec5b9b178a3537a3c4c3b09575485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYpsvZlQEwAQ&v=APEucNXnrxBwEIi8FfXlN5IzbB5mA7U_lCVj9DTPkm4_r8RohpomZCMMe7C_-4a4Rh18MJl_Lxr6gCgxBUR_VoDpDZZrTBkYsu976K_32KqYnel9sb2HYHK2V4tP9VYkaNcFzrV5pPtYviK86sGJ96z4TVcx4PWxBjk5jVacUuujP7nlO65WxiqftNZjx7-M0GQL7cXbHkuuU_YGwWXDW3p0yu1KGj-gvA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm7Ys3tgK11p7R7-ty0rFkqUrBVI1jBAB7zOKR0CX6v7KKxD5x5oNgV55e834I
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 29 Jul 2021 01:07:51 GMT
server: cafe
cache-control: private
content-length: 313
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 00FA 24 KB
13 KB 47ms
44ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BPCl-jsjv2pFipaGLBXXJQk1QHIvWwfHF6HFG98lDcC6MioeHBB9Ba3lCwIC1qNrBoMBGFe1kY1xhwK7y6Xp6SuT-p1ODvuZpgbqAWgj6H4UyioEcudXzBVnJMARY7Nd0ICzqPGRbY3k12XDHSOXLMDI6_3g&cry=1&dbm_d=AKAmf-D_9aAfeQGLJl5PbWfBPMp2Rl2CpMy9wztDcY5TQJTG5XNSUcQ3JtFHUhFvd3iddkVNT0vBpHU_VDHu_RGwAjnEYJ2QaIldbXToABtoMvOBZE77S8cAevwLyPiKMMvT7H6uIKSGfBm8BFtNc2siVpkTSNONN7hVgjFeEboXR1TenBTc0ZmsbOQsmIVvqtkmIG37pk6qbqaMpKu_9T7izFE9qfWS9g964umEJtFQjLsI4lEAAL4OSiZT9lfbdO9VNlFq5zvNCP8V4uPJs2hKHB3R1ZkjIolLMunvZ_X-6KY4BxbkceC7p2dwWG4RoKh-nGZmner-gfyvr-5-kM3UE-4ygHx0yyk0Luv9DuLNwS4hRzZ5a0KdELIKQ9qfujm9HA1fNUWT5d43WYFb_KVkhK33W0KK3sE2U1xHQ0LUvWJSeRCz2s0tSAvE8q1s_nAVs7n6f1r_5cMAl3F2-IPtqy5Spehha5cgnIKNRGIQh9H5nF30-NfwLHD7Ardz4lH1zrIQFIDI-7_HEtNxtrUaVXCJCCiJHggUh_2Aktt8Gc8CEDFBdEKZmdAHBN9Uz7fl9UKHE5BXOf9-LUYrlVE6nHlsNr7oczl7MPEKBVJFPbRcByg-btQsdYz4tFaW3V3QedcRtOe3DZYc6Sl2TNBebOcuYJSZregPyYBrNSSrG6clqWe6fr9oK1bvBfyV65dMvgquiBorRvwr3q70No7nz5JJo-jLHwTNaE-vMHjDG0C129WgebhPuB9whkkNOsbRjuUFZqHXhRnACv8P3sZHIbBXKMjgc1oVKw9qq5_TjuDr7DRE41_NEOEYBw5w6iGkq_BQW3_eQXFSQlW_3XSMfVJFdwde39P90AOh18Gb12em4BDvXObC9q3GCHtyGfPvKar79DTPrCLnto8qhq5M9TZvZxDDmtzH_a0xmDMBTuBAFfMtp2fGpZWmi7YOBWOEe5oXDX3Req9Zi1ExTG3-XPpUoklSxORFD6_oaQBX7VSvWZmWVeMC8qgA31VMU1aR4RsfZ9gTNDQ_ormIUT-nd8vJyG15cROPZNlfSlXh3tsn0e7YK5YlWUHbXta1I6SCc2AMIa_ROwtksUCwaq683kViEsZXBYUKSXwxwDK8iZM95OhiULqmSfUhPhsR854yXzLdA9H_Q8_y-7qhkvbPtDmLu4EV1Tt1wBDrEgGF_GUpv4F1SH_5joYrft3N_AYxZIPw7eOTwtb_HQbf9Qfwcbzo8qUYMApIb9udlK6Z-8YxsZbRbJtDyVI4pUvd7M1hK-2M_c_5bqkruvJ3p5HHSxjrPoEiZGevT6fMp0XHBOSNNrK9jAiH38zYHC4N9LyKl_3TozNGu2ysQOnIlrClVXdEB2q4X_ajp7307klCvolSkpWOdx2WMW8R3wOkQmPiTxvoGbGxbV_qTaz9VApjBPCCJo5qpI9OYPIZF3bYOcI63uaQBvLQ_I41p3T6s7hxZcxu3kpWvmrlvFe7EJcIKDfT8F4zfBQy0ZkBo7FiHCANiYChCMCz4ErOWtU2FFaaLfgMhVxJYLT8i8NiozX1XlghzZsDRxJTLxiNljd84vCFYvtZ3pD8cQQ8t9iNglEZ1RfJqs4ebU1jbe0gyj-ARQh4GjjTPGHDN4AcTYOtx9NBO4hjh4TJ8IpJxiXwus1D1r87RVGtQZvrtpFCDn3vKg5IpafpVWmStSYLm52bt179YOuVtfvs61NowJG-ACfplMfkDYxgZfwjopLNQbcuLLpL-Z5MZSX9WKkwrTtEjPhTnCYJXPg8LHOQZd5t6tQfgCistbt-wGUm3fiFuXR0VRTdG0MLErUGmyV6jwgqELI6CVswYBT5XYhNkOptp2LX74bBOUe5nSALfQZGXX5gJhZ0YUhu8evnU9yoiLdO5zQ9jEIuMqLSzv_MhZn_WGP7GdbGf24vXLqCBAUXVafpvoiysY3bxZW0OZpoyYjMjHTe2F0CqTHd7zGSPrTfIzFNoSwpU0jlDpIm0v7i6sTo5ln-0rpxQg5G1xPMugulpJxXXfAjSQATBsHHo9TaX53sh7tkzi6QtnFN_A547gTEPR0XFUPisKEKgg7-mt7ZqV7Rt5GUjlUhf55ifv3oaAtNOLvu6-LToTadCsXFP7JFEsbXmnZ7si99hRSrCWhyC-rPEArrJHRRPkivlkXWYmGyM1WEpzJQl_Q9sRqb3WMnFolMW9dyUZa9ryeOeJrtu58PURHYnreEodIMc0p9ilp-OadHnPLy1MEPnT8ufQf-kvMKVnUE4GJ7RzkLGL67JUJE4B-9S9IFw2Jt-NwW4j3bo7sBUBfHU4u4Y6a1bUJ4EEso3ifhAJLYmRbU61G-4TNxrezkXSycjxWDc3o7VsY-Ih-hZYegqkqiQmnpusbj63wucUMxYHrKin4OI_yUCC6l3I_eK0Izo6BvC0VKbsQ05ZIG0vQqIEEXHuLRSu24BVKR_GWMECwgQU3CvMN4AKVMgdJOXueksAu9wT1_oltc4m78xM3v59PNt4NgoSNnLqhAyhb05zuwjosuzUIyNFt8_QDx5BTjCrKL_DyQyREZPLtoEVf2ki1o2hsaF_icvm_va8prD3wZ0N5bSzFzEUiPBF4sZ_jZB21La6A3CU46tiVHMOiXwHMgtnd-2zxz61vP1UU-n_9o8ryupZQv--zDh_Jd7cqG4dNNiGiUa9Hzm90q3t9cRt2W6AxnWlR4C1_SAhUQawlEfLQTmR-5k_WsNIBlJG3W_mNw7ZIsq7VR5E0LZHKIF9zz-cw-0BBOzFJPsyL5TG1nXXI_zIjPlZ8gM0AljvSYj3qDJR3TYbCSTAnxyzkKOJF5reEFM5fAsoAqj0OQ_CIH4Sp2ohl6XJGGxOYEWMPLI78BLORG45NwXt85_Mzwx2Als9PGH_p2Q_U4Gat-CoNjpGun6Nw9QXh2NA_v3tyUYxOBriQej-7mtdNwoadnwxROmrwZavMiLYCnYx0037VWlWaKQ3m5BpnIbK-QxSZQ9KG_7GulTV_pK2tQ25TsLycGwIb9rcbycgxu-2mbdhYYs3ubPsRxJsLWLO0S8Hu-6-pm58r2Hr4J02WX-swBRoNR5oiqdPQbt7WsQl6zCvQ-bB92q7FT9QboPgfcbKznSVsSE2Bd-Nith09KcDXqB4w8jO4YNoo7m6rSsbze9T2thWy-mGGRUNvGq1lO4pFMzAC1nt7jd6uvktf2W0oV1sC8Xzivts8NvhI8zuW4YWZI7vNq2YzVhJiFM_p-0So&cid=CAASEuRoZ-T2LfjuBnn1meUW-TD4Ng&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Requested by

Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18ae8f8dc2107652f3e9dab4d868a25ddfb16ac424d549e35a2a1887de7b3713

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12835
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 00FA 42 B
63 B 41ms
38ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BzgFnOs5AvKpO64syLo8ddo6iZdH12YkUZ0u4TPI-UaqdCStwQQnKGMTNqxiBkyjLwCRyK9-hV8jLDmv4jjKTMZSpKajF48KzyU6e8sy6UA7qSxdc

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame 00FA 2 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 00:00:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4014
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 00:00:57 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/ Frame 00FA 14 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210727/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d8a9aaecb7cd39329dcfad9a882ce0d174802ded027e150440484e097c73cb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 00:45:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 18081889583213459188
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 00:45:36 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 00FA 0
0 16ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQCezPQWaatgzgIcYXNWCxE-bfHxQ1eBplB3IzBbcwrEY2nT84WAdwQyeGpWb9GMOKWbrdtdFiCX6WF25k9s-5WPUuJjw
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 00FA 124 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ee596b76772ac1263c57b05c3d05329db5e875cbcec8e917047b5d221fbb1c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627298817379074"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38160
x-xss-protection: 0
expires: Thu, 29 Jul 2021 01:07:51 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame BEDA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELcdN7s9iFozdX1wS4nBo8Y&google_cver=1

43 B
172 B

21ms
21ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELcdN7s9iFozdX1wS4nBo8Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELcdN7s9iFozdX1wS4nBo8Y&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEDA
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzA2OWMyZGUtMTk0My0yMjkwLWNmMDUtYTE1Mzk4ZWM5MzRj

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzA2OWMyZGUtMTk0My0yMjkwLWNmMDUtYTE1Mzk4ZWM5MzRj

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 29 Jul 2021 01:07:51 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzA2OWMyZGUtMTk0My0yMjkwLWNmMDUtYTE1Mzk4ZWM5MzRj
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame BEDA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEBeivfeQlCGSaI978QdtouQ&google_cver=1

23 B
172 B

68ms
52ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEBeivfeQlCGSaI978QdtouQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 29 Jul 2021 01:07:51 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEBeivfeQlCGSaI978QdtouQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame BEDA 23 B
172 B 109ms
51ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYwKG1PTAB&v=APEucNWsA7ByBKeXM3iF9b2YHXmdOsyCG-0rDrS-ySIKk_0a-BrWzl1iAizJzE45x-oYLwvbMQK_nt4wQ7amZhjEZC0EWVwVmG45r3vN0E8fLsUGVLp0kxkBd38pz_5wmkCJUcy7J21S-k7bqZ_y-eD8Mv2AmYeTHkTtfvb-NjR0u4X2BBNFa9jTVR96wVFhM39P0gFcCgzf1t13E3NwsOf9EOfAkAns2g
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 29 Jul 2021 01:07:51 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H3-29 200 5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js Show response
pagead2.googlesyndication.com/bg/ Frame 3085 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e43a0788007c81c88e5f2e2d37edf449a9a0adff50ab76c8cb5b1c8ae76f5860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:52:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 108917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13434
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:52:34 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/ Frame B236 24 KB
9 KB 9ms
5ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CT6SNVGt3ZrVxfy4bTceBTtX8MtoqQarCzaQSys9c8tro3fisY-XILPEnLVworqDtjHes-u4w0WOQ-K5SfYhH_kz6uXgLS-Vaj0wsApznYUf3fmVfSD6UiGMoaQnF8RbgEinWpHUXlk-F11iQf4wSM9m-S9Q&cry=1&dbm_d=AKAmf-AgwocuAHRJQpzp8knZ4BC-d_roiHoHkgYd7IEmUtKZoNFLdyuhkg5NBIidH-TaXSBldGl_KYHDuQvZb9UmlYwh_e41ITPRRpopxM1rVUS9pWsHKxfBYqYcEe3xLIJU5dF0yHJnKbM0QVrYVr5_wjcXCVQX0C9luKqNIrEECBfJLIDuCd1zxZ8e6OZCnsE_f06toePWDtXv0Ih71FdkwGFeGqRg7d704tEa0-jYJAq9VTdaoUJZR17MJZ7_ptsnIwabxjwCZacOqIjaTvwgY2g0w0QIyX4I0gswN7dw73FDRPhpf-JoUSug69BD6cWKSj8y28K1wT605yXPTLP2JfS4wcu5KZB_1I7kk3uYlKyKd2uGR5i0m1dVdSKLOR00Wa5TEmt_zrVngb-9jd6_60R81UO7l1qOfdbs3Z8xRwZaq1af8isRRvMVhoZFxylDwmH0qRBwLHakL_8EznizBAS4Dl5w-HRZw6APKvYLTUFXJ9ylSAeryT4jGorjLUSeQdOk57KG8FQkF16DGIMpakRJMX8n0BbUAIKAC_zwwJt0GLeJp4QOy5I5OeQKUma4ukebjFwp78m1oKaxKkhvjg-SIE4zuf6nWNxZASiGHZCh7vY8MGwG_g-d4vDfkVt_thFaj99PKAeilgm6G1JVXfiC9gTupZAikbJc78Eg7zRHriNTd5YkH8sVoaalw9enUXR64_KOBit1NYvYFrljKl2hJjm64SuHCKX2vjJa0mcBV9R8LIjznDVAbhZBU5QQ_qdnXzaikzvq-vh8MHvF3X153tdBZycU5s5eOnhm8y_qGKKi4dLt048v1O-JkRSTu-g9qcbRGyjQLVOdUOiP_GZHVrQ3TRbzk98OwNobLVRyvOGWC-i0UxDqrG13KOFFfVzqpzdFB2vlejI0_q5V7cdJdx7BKUOYUCtt8Iw4CDR29tNqark6nq95E0JRzPc6TSkWMpUQUA_BLdQRbsVDFFZnu1mGSWuwxcc9AqxiX_NMAWt3e2J7z--4kHaIB7R-bMbNcTnX5nRCwlLqXy6eefAUunAW2NWP6euBZ93tmlQKTNrVQphQyHSCYWOgbo3vTU9haQqFR0hjTFSTtpZzUngYu3F1d-a-IPwuCUhCynRsZWN1FECWAZoubEwNeUXGm912CoOsYURCP4ZpaauPjPm8J-Yb6eKRhICxnPnCLqNDHb1FxKEcdLM3qzRjl4XmtA6RxwuR9b4Bsv4qTmZ1JRWGDSsa8C55fyirEwzq7mgUMDhg_0Ka2TsTDZWMd8iuXS_hvd6j25wEVz2XqXKt4f3TaxlN9jXnhsOkO56jyuc9lO2hipM5Ad0lXvh1z9cDpnLBhAqwDCm1enK4BQlDkKnduMhpUjMA-GUz8fRLe7U0hu-LC1lpVN4OTuku5sz_mLWHfF0-m0AmPvUYxyj6dO_240g7nqJggXbLZSwynIp4rCsk9jIvJn8YKub2BsjHmusGa7pjTszcFtnIZ_mAKBGk4nfqHw2LBuiqeUtvCyi4l1oaFhAziWAhxxBiYbOIEQv8YyHD3GmnWr8QQdQF9maL4o1ItwgaLDigG748Q5KumrRDlewb-ohcZEs1sAOWTGdacZwJKNxJsbXRssGIG-ibw90TOGvNq-QMjEiiXgJGlOLDiKlIAcksXWzKpycynnZBkiI5t4tACd2EkDSXu3mJLsSi379euaEDvIpKp-l9Xm2gjt9rpoBfHWdVV2q-U487I98c_xe6ceNHiuIuWqW09i9NNu7rRwDbKXtKEJG50PLWzFMHosWbbnQMy8P9so4FrSK-E_iuE13XSej0DscM9CbZB8kAio-7okQCJ4jkCJg3E6kBXJCfH1TD8tWU23C1UR736hEl6rpjp6CGVmyDwV0arSBf2r2Pwq14rekxa-0I_7SeVGk6ux0yfPHzrD41b-qdWTgwjEqx6n-PfOv81G1IDRaK7L_hTmjXFa9zgGJ97wEvIjXUtWkutxHUhk1s6UAD4BTotHYe1_K-q6qdaxr4AvoFTprOtAf-tyYaQPOgn3X8ApyHK9P6L0CbMYVKcd2No3uuDWc6M49VLJ5JmajaTgzji1ZpB4T46NbpNdencCoY4SjCA_2UkKEdXxKOepDuFintMxaX_-mSqkmGBDr5w8qxyxjwJJVdo6MMLD2uexLvWFNPtkwVEL5zBKt7O9syV25G3bYOyQ5MIWTzJCJ3IKXXBbfJYLI7nkxBFV2q8hOR0q-kg23CvBDtrwrWDrlDCNHOSYtRkpOTfwL2DwZok9y9txdh8anPhWtCMKMg_i1-Dvwn68UG9xsnCQNI4ZbIMZdXNqt6rPbbEh9yStdASnLNqFABJ5tghw32t5C-SxrHFsnJcMVr2JDnWS5g-614C_NcRMStNUullWuZJ3EKUz2cAWco7T3x2u2d833KiU8vv3NYw-7i6c390Jw0Hir0UvRayVL8CQPHd9ZKBr64ukn41AiNnspK38pXJBDTZACgoC7VOtKnYpTcffBH5lpU1MmTNfCt-9nFEV30gTpztp-rVeHDvnSZByCtP605-IrA9FMTV1ggdKA33XelPv34Jyxhp2rv_lqj2exMVwWRoJBiiZT33TiSe319WPdKL6-B_Sazy4hfv0M9lJBwBuk4hQWZblWj2p5MrnDGRsih-oCQxDD3YQR4X6vKTBei5BVO2wMrQ0Xgg50au9B0vR51Jm6FkxeFVhjbBnAMxSwLusiH2rRd7A72PyCVE1ma59vz5YH10Uikhl5aaLLOun0POfJqfCEsc6ZS7cl5daqc4L2JH49VDydlTi9pF4U7aP4V4i4yEfctXuuGmVZBn22fmg_4UEOKJhSIhOL9DEh9GLSHeRWs5Cenw_U7iQ3cCTEl2gfpjCuJnI-PnTPSnavHyff9dCtEagqIz6KeXrJSe0mcX-uyRdaz1lMLjbDmInvN3T3uGyQnFEY6LHbUYoZlJngvxNBCO4sXTwAN0YzCI0o9IMyEWsvvtQ8PVa5Qzm38AMGSprTIq-Q7TpcVIceQjiPQKaG0xJTQBfRFMKejIjjDkE-O1Ve2XQE_VeUU15yQl22OUJVNaKIHl2IYDieH1ZV2cXK8wn9-PsBC_F6PmX93gDil7ZSPF__Hi5jK14pX7R8NRYKVvE4HtynVsYAlEXz_3LlkXZ63s-yogVJ71aLhe4raSwfznjkGyATEFIU_kzG9tIy4NaJHhRbFYImwYsJZHNFUIMREda4aFeoLT05YYiFD-5GamxzeSiG_-Ek&cid=CAASEuRoR2tLErkIVeyGs7h0dkeeZw&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:05:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 01:05:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B236 41 KB
15 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 15:17:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 15:17:35 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 043C 0
48 B 18ms
17ms Script
text/plain 185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156983&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:50 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6FC1 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 26 Jul 2021 15:17:48 GMT
expires: Tue, 26 Jul 2022 15:17:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 208203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 2D12
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEMFrD42j5wSRz0J6vGhjr88&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEMFrD42j5wSRz0J6vGhjr88&google_cver=1&__user_check__=1&sync_id=664d802c-f009-11eb-9e71-1e1d47870506

43 B
549 B

32ms
18ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEMFrD42j5wSRz0J6vGhjr88&google_cver=1&__user_check__=1&sync_id=664d802c-f009-11eb-9e71-1e1d47870506
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYpsvZlQEwAQ&v=APEucNXnrxBwEIi8FfXlN5IzbB5mA7U_lCVj9DTPkm4_r8RohpomZCMMe7C_-4a4Rh18MJl_Lxr6gCgxBUR_VoDpDZZrTBkYsu976K_32KqYnel9sb2HYHK2V4tP9VYkaNcFzrV5pPtYviK86sGJ96z4TVcx4PWxBjk5jVacUuujP7nlO65WxiqftNZjx7-M0GQL7cXbHkuuU_YGwWXDW3p0yu1KGj-gvA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:52 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 125
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Thu, 29 Jul 2021 01:07:52 GMT
Server: nginx
Location: /partner?adv_id=7025&uid=CAESEMFrD42j5wSRz0J6vGhjr88&google_cver=1&__user_check__=1&sync_id=664d802c-f009-11eb-9e71-1e1d47870506
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 104
Connection: keep-alive
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2D12
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NjY0OWI2Y2YtZjAwOS0xMWViLTk3ODYtMWJmOWFkOTIwNTA2

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NjY0OWI2Y2YtZjAwOS0xMWViLTk3ODYtMWJmOWFkOTIwNTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYpsvZlQEwAQ&v=APEucNXnrxBwEIi8FfXlN5IzbB5mA7U_lCVj9DTPkm4_r8RohpomZCMMe7C_-4a4Rh18MJl_Lxr6gCgxBUR_VoDpDZZrTBkYsu976K_32KqYnel9sb2HYHK2V4tP9VYkaNcFzrV5pPtYviK86sGJ96z4TVcx4PWxBjk5jVacUuujP7nlO65WxiqftNZjx7-M0GQL7cXbHkuuU_YGwWXDW3p0yu1KGj-gvA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 29 Jul 2021 01:07:52 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=NjY0OWI2Y2YtZjAwOS0xMWViLTk3ODYtMWJmOWFkOTIwNTA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 69
Connection: keep-alive
Content-Length: 0

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 2D12 0
445 B 20ms
6ms Image
text/plain 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~b04e41039133c73fafd60e0ed8cb49a70ecfb061&nwid=10000483131&sigv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:51 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/ Frame 00FA 24 KB
9 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210727/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BPCl-jsjv2pFipaGLBXXJQk1QHIvWwfHF6HFG98lDcC6MioeHBB9Ba3lCwIC1qNrBoMBGFe1kY1xhwK7y6Xp6SuT-p1ODvuZpgbqAWgj6H4UyioEcudXzBVnJMARY7Nd0ICzqPGRbY3k12XDHSOXLMDI6_3g&cry=1&dbm_d=AKAmf-D_9aAfeQGLJl5PbWfBPMp2Rl2CpMy9wztDcY5TQJTG5XNSUcQ3JtFHUhFvd3iddkVNT0vBpHU_VDHu_RGwAjnEYJ2QaIldbXToABtoMvOBZE77S8cAevwLyPiKMMvT7H6uIKSGfBm8BFtNc2siVpkTSNONN7hVgjFeEboXR1TenBTc0ZmsbOQsmIVvqtkmIG37pk6qbqaMpKu_9T7izFE9qfWS9g964umEJtFQjLsI4lEAAL4OSiZT9lfbdO9VNlFq5zvNCP8V4uPJs2hKHB3R1ZkjIolLMunvZ_X-6KY4BxbkceC7p2dwWG4RoKh-nGZmner-gfyvr-5-kM3UE-4ygHx0yyk0Luv9DuLNwS4hRzZ5a0KdELIKQ9qfujm9HA1fNUWT5d43WYFb_KVkhK33W0KK3sE2U1xHQ0LUvWJSeRCz2s0tSAvE8q1s_nAVs7n6f1r_5cMAl3F2-IPtqy5Spehha5cgnIKNRGIQh9H5nF30-NfwLHD7Ardz4lH1zrIQFIDI-7_HEtNxtrUaVXCJCCiJHggUh_2Aktt8Gc8CEDFBdEKZmdAHBN9Uz7fl9UKHE5BXOf9-LUYrlVE6nHlsNr7oczl7MPEKBVJFPbRcByg-btQsdYz4tFaW3V3QedcRtOe3DZYc6Sl2TNBebOcuYJSZregPyYBrNSSrG6clqWe6fr9oK1bvBfyV65dMvgquiBorRvwr3q70No7nz5JJo-jLHwTNaE-vMHjDG0C129WgebhPuB9whkkNOsbRjuUFZqHXhRnACv8P3sZHIbBXKMjgc1oVKw9qq5_TjuDr7DRE41_NEOEYBw5w6iGkq_BQW3_eQXFSQlW_3XSMfVJFdwde39P90AOh18Gb12em4BDvXObC9q3GCHtyGfPvKar79DTPrCLnto8qhq5M9TZvZxDDmtzH_a0xmDMBTuBAFfMtp2fGpZWmi7YOBWOEe5oXDX3Req9Zi1ExTG3-XPpUoklSxORFD6_oaQBX7VSvWZmWVeMC8qgA31VMU1aR4RsfZ9gTNDQ_ormIUT-nd8vJyG15cROPZNlfSlXh3tsn0e7YK5YlWUHbXta1I6SCc2AMIa_ROwtksUCwaq683kViEsZXBYUKSXwxwDK8iZM95OhiULqmSfUhPhsR854yXzLdA9H_Q8_y-7qhkvbPtDmLu4EV1Tt1wBDrEgGF_GUpv4F1SH_5joYrft3N_AYxZIPw7eOTwtb_HQbf9Qfwcbzo8qUYMApIb9udlK6Z-8YxsZbRbJtDyVI4pUvd7M1hK-2M_c_5bqkruvJ3p5HHSxjrPoEiZGevT6fMp0XHBOSNNrK9jAiH38zYHC4N9LyKl_3TozNGu2ysQOnIlrClVXdEB2q4X_ajp7307klCvolSkpWOdx2WMW8R3wOkQmPiTxvoGbGxbV_qTaz9VApjBPCCJo5qpI9OYPIZF3bYOcI63uaQBvLQ_I41p3T6s7hxZcxu3kpWvmrlvFe7EJcIKDfT8F4zfBQy0ZkBo7FiHCANiYChCMCz4ErOWtU2FFaaLfgMhVxJYLT8i8NiozX1XlghzZsDRxJTLxiNljd84vCFYvtZ3pD8cQQ8t9iNglEZ1RfJqs4ebU1jbe0gyj-ARQh4GjjTPGHDN4AcTYOtx9NBO4hjh4TJ8IpJxiXwus1D1r87RVGtQZvrtpFCDn3vKg5IpafpVWmStSYLm52bt179YOuVtfvs61NowJG-ACfplMfkDYxgZfwjopLNQbcuLLpL-Z5MZSX9WKkwrTtEjPhTnCYJXPg8LHOQZd5t6tQfgCistbt-wGUm3fiFuXR0VRTdG0MLErUGmyV6jwgqELI6CVswYBT5XYhNkOptp2LX74bBOUe5nSALfQZGXX5gJhZ0YUhu8evnU9yoiLdO5zQ9jEIuMqLSzv_MhZn_WGP7GdbGf24vXLqCBAUXVafpvoiysY3bxZW0OZpoyYjMjHTe2F0CqTHd7zGSPrTfIzFNoSwpU0jlDpIm0v7i6sTo5ln-0rpxQg5G1xPMugulpJxXXfAjSQATBsHHo9TaX53sh7tkzi6QtnFN_A547gTEPR0XFUPisKEKgg7-mt7ZqV7Rt5GUjlUhf55ifv3oaAtNOLvu6-LToTadCsXFP7JFEsbXmnZ7si99hRSrCWhyC-rPEArrJHRRPkivlkXWYmGyM1WEpzJQl_Q9sRqb3WMnFolMW9dyUZa9ryeOeJrtu58PURHYnreEodIMc0p9ilp-OadHnPLy1MEPnT8ufQf-kvMKVnUE4GJ7RzkLGL67JUJE4B-9S9IFw2Jt-NwW4j3bo7sBUBfHU4u4Y6a1bUJ4EEso3ifhAJLYmRbU61G-4TNxrezkXSycjxWDc3o7VsY-Ih-hZYegqkqiQmnpusbj63wucUMxYHrKin4OI_yUCC6l3I_eK0Izo6BvC0VKbsQ05ZIG0vQqIEEXHuLRSu24BVKR_GWMECwgQU3CvMN4AKVMgdJOXueksAu9wT1_oltc4m78xM3v59PNt4NgoSNnLqhAyhb05zuwjosuzUIyNFt8_QDx5BTjCrKL_DyQyREZPLtoEVf2ki1o2hsaF_icvm_va8prD3wZ0N5bSzFzEUiPBF4sZ_jZB21La6A3CU46tiVHMOiXwHMgtnd-2zxz61vP1UU-n_9o8ryupZQv--zDh_Jd7cqG4dNNiGiUa9Hzm90q3t9cRt2W6AxnWlR4C1_SAhUQawlEfLQTmR-5k_WsNIBlJG3W_mNw7ZIsq7VR5E0LZHKIF9zz-cw-0BBOzFJPsyL5TG1nXXI_zIjPlZ8gM0AljvSYj3qDJR3TYbCSTAnxyzkKOJF5reEFM5fAsoAqj0OQ_CIH4Sp2ohl6XJGGxOYEWMPLI78BLORG45NwXt85_Mzwx2Als9PGH_p2Q_U4Gat-CoNjpGun6Nw9QXh2NA_v3tyUYxOBriQej-7mtdNwoadnwxROmrwZavMiLYCnYx0037VWlWaKQ3m5BpnIbK-QxSZQ9KG_7GulTV_pK2tQ25TsLycGwIb9rcbycgxu-2mbdhYYs3ubPsRxJsLWLO0S8Hu-6-pm58r2Hr4J02WX-swBRoNR5oiqdPQbt7WsQl6zCvQ-bB92q7FT9QboPgfcbKznSVsSE2Bd-Nith09KcDXqB4w8jO4YNoo7m6rSsbze9T2thWy-mGGRUNvGq1lO4pFMzAC1nt7jd6uvktf2W0oV1sC8Xzivts8NvhI8zuW4YWZI7vNq2YzVhJiFM_p-0So&cid=CAASEuRoZ-T2LfjuBnn1meUW-TD4Ng&rfl=1%2Chttps%253A%252F%252Fwww.ranksays.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e0b072e0b1f96186a779eee12b838fb8ac4372baff6c3af22d3d27caeb18bf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:05:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 14963318235020188028
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 12 Aug 2021 01:05:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 00FA 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 15:17:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 15:17:35 GMT

GET
H/1.1 200
OK mu72dqmlk6df Show response
hal9000.redintelligence.net/zone/ Frame B236 11 KB
4 KB 1136ms
36ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/mu72dqmlk6df?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmeNrZ_8BYaPHA-yK7_UPyfKYkAvisNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Qm66rC2kEtUMElnscC_Qv_NBut9Z6bFl5FWoPSJEDPoI1SEUYhrjN9LORhpAaAfOtc6QfG3VAvTq7b9CIX7btBBJPjLlLCgqxgcUZZezUyjEugpVGCdrs11KHEDXDXVLNZn0VaF0bbJAmUYANSIIIg7HxKupvZa-7MzzWYPej_8JcXjztftKF58uhlFTzcsNcHBvTF9P6PNlBlfb9d3hfY9SG0Yq7d9uSHh2uK9xOD-N_nW0gyy-9EDFjcAfi0ULYcjim3XJ_Aa4AU9ulwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoR2tLErkIVeyGs7h0dkeeZw%26sig%3DAOD64_21gC56K3s7cY2PewagTEnOZbLPww%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-DDOVXZdT-ILmv2kKHXpBcwvQ_bLjoyExKjt5RZ1awZO0kcujs5R9qF69HiSO0Ol-qOW0xUCJkO1-oR3iA9qRfaPJN206OOGppxjW35rokLr8EL56ykYwHrVxTHl0FikBNXcz0rZDAe_BHDWlgUluFslIcskQ%26cry%3D1%26dbm_d%3DAKAmf-Au2Tk4CnIBSvn_tWBP2PLDx6nMnINUCirJY2Xm9behVOm8NZBkfIUuSjI10SD_o23Zp_hMxFFyk3JPPodgq3RKjCBrddllJuK179Vi0RhEEd5ZZvQMLpUOgeZYzjrlzuu9R_javhFj-8_hx5G3__tr7d1cXxnC3oyIA_rzOc9tYZUNuszmcmi-DKiM41FhNT8_6mRWGYApncIBBsEZX2aA_0bgqJbTOBhbPVk8PvsO5bIx9HetvWy5nE4592-6L2GpkUkBhepQvKxKg_4UTfBZZsFeU_AcNL1nEJIuOAsSnVvAIP1hfuszl3p_klypJ3flUn3h_FoOBmqZhtMK7AV-dhDSHkMIFaM8dA2yTBjSLIw3HVDYxOOwW8S6YQDrBo_yyjvQHlnJFnRun8gf4BNhxOtFtPlDyit3FtODuK3m16HJUofkQK1nETFJUmjL5FDR-Kzy-3msIWINPsn2eL0r1qu8JQ%26adurl%3D
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b0d11aac3055b7b719abce662a136fe439db0e03ad8e5494bceb0220c7a6607e

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:52 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3928
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
hal900015.redintelligence.net/ Frame 93BD
Redirect Chain

https://hal900015.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=22fc3208dc&subid=&uid=7cd9c85f309f2c08&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900015.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=22fc3208dc&subid=&uid=7cd9c85f309f2c08&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
2 KB

401ms
88ms

Script
application/x-javascript

138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=22fc3208dc&subid=&uid=7cd9c85f309f2c08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1VOgZ_8BYYLLA9fU7_UPnqax4A7isNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Q9Le486AgMy3LQ_4sOSXlzAMxG7uIfSmUKos1SC7hpgJZTwgSfJKTrVWRXGfqAiuAwHMxaIhDunGbgFAwy2db1lWIsAZJ6cKsmJXpS5RnsVJRH3qxQkdmzS2qRppWyTJNXNJp6LR2M-_2GZMv4aaFZTeNhJiGGaz9Ybh1KJreSqsGPGA0jI1jYLTBGICDShWxyxXDQkigpApBQ678EnmLQvbqoAOZfiNmFmOLCwCugbjMolgnyGxBZlJXkqrOkNzKjSU7qKclWYN7FuPvwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRokQ38ZjzMIcTwAw-TI64vlg%26sig%3DAOD64_0qMqBWafjk-aMYwJesiTd-lU8RHQ%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-D7g7YRBKNyo_kKXbgt3QIw-g8zDTZhDezH-FLHYp4pmVMY0sT0vBWgsUMKZd5Xtw9IdKtJwKpqY2uxugx_fMXw7VnHRZN3E7ZSLdeABXlGFMt3t_Y132OwyMlDXLCXCLe88oyfzup10JgKIAQ5QXUIHx2HQw%26cry%3D1%26dbm_d%3DAKAmf-DVbNFjcPLf48Qlm7Vrykxqa92_7Lcz5C59jmAYUQU7k7JL7P1oGHxnsQsUqKByULhlVImKkr2mv7_QPC8C4hNhWqgZn_KOFzxUkHsWU1DSoF-g4h9FRsFDHJ5kU7r8trbqDOeoB2bQEQ_bqpgANxqeuzAV8mX_DUDWM_MTSO9TkNaJJjIjcJaA6aFMH-gmAr2z5T9wC6OikkwYW6ZpjRD1Mr4DeQnDCLwv1nmhUqxAToQLsUOrnkxyX6GfU8TlynsS2yjlDz0bZbGBeAAJ4wgr0BYaQJpPAXKhHUt_j78_Z-8tfTkKViq4TPIAP7QNN2CrEEe4aHswr7E5PVueyQGq2YGHvLYRQ02ClVtvC-Ogou1lB5rV2Z4QEkOBTjfzvpCAgYuquAN4HsReBJVLAnjSdduBN5AkI_Gbgk33W0LNLEW118jcU77e5CkcbiRpfCyiXWHB7a-Rbn5Hb1IXM8zfEXHsfQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=3780560379201&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f825c2c2389b5029081d78826c07161848fb96fb37afd66ff329351aeaae782a

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:52 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 24909700008367800719594011670015
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 951
Expires: Thu, 29 Jul 2021 02:07:52 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:51 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=22fc3208dc&subid=&uid=7cd9c85f309f2c08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1VOgZ_8BYYLLA9fU7_UPnqax4A7isNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Q9Le486AgMy3LQ_4sOSXlzAMxG7uIfSmUKos1SC7hpgJZTwgSfJKTrVWRXGfqAiuAwHMxaIhDunGbgFAwy2db1lWIsAZJ6cKsmJXpS5RnsVJRH3qxQkdmzS2qRppWyTJNXNJp6LR2M-_2GZMv4aaFZTeNhJiGGaz9Ybh1KJreSqsGPGA0jI1jYLTBGICDShWxyxXDQkigpApBQ678EnmLQvbqoAOZfiNmFmOLCwCugbjMolgnyGxBZlJXkqrOkNzKjSU7qKclWYN7FuPvwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRokQ38ZjzMIcTwAw-TI64vlg%26sig%3DAOD64_0qMqBWafjk-aMYwJesiTd-lU8RHQ%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-D7g7YRBKNyo_kKXbgt3QIw-g8zDTZhDezH-FLHYp4pmVMY0sT0vBWgsUMKZd5Xtw9IdKtJwKpqY2uxugx_fMXw7VnHRZN3E7ZSLdeABXlGFMt3t_Y132OwyMlDXLCXCLe88oyfzup10JgKIAQ5QXUIHx2HQw%26cry%3D1%26dbm_d%3DAKAmf-DVbNFjcPLf48Qlm7Vrykxqa92_7Lcz5C59jmAYUQU7k7JL7P1oGHxnsQsUqKByULhlVImKkr2mv7_QPC8C4hNhWqgZn_KOFzxUkHsWU1DSoF-g4h9FRsFDHJ5kU7r8trbqDOeoB2bQEQ_bqpgANxqeuzAV8mX_DUDWM_MTSO9TkNaJJjIjcJaA6aFMH-gmAr2z5T9wC6OikkwYW6ZpjRD1Mr4DeQnDCLwv1nmhUqxAToQLsUOrnkxyX6GfU8TlynsS2yjlDz0bZbGBeAAJ4wgr0BYaQJpPAXKhHUt_j78_Z-8tfTkKViq4TPIAP7QNN2CrEEe4aHswr7E5PVueyQGq2YGHvLYRQ02ClVtvC-Ogou1lB5rV2Z4QEkOBTjfzvpCAgYuquAN4HsReBJVLAnjSdduBN5AkI_Gbgk33W0LNLEW118jcU77e5CkcbiRpfCyiXWHB7a-Rbn5Hb1IXM8zfEXHsfQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=3780560379201&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 29 Jul 2021 02:07:51 +0200

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7041 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 26 Jul 2021 15:17:48 GMT
expires: Tue, 26 Jul 2022 15:17:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 208203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK mu72dqmlk6df Show response
hal9000.redintelligence.net/zone/ Frame 00FA 11 KB
4 KB 1117ms
37ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/mu72dqmlk6df?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a76c5555332185c2d86ef91f4960743bb891a2308a168d30c3316b290eddcfeb

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:52 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3945
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js Show response
pagead2.googlesyndication.com/bg/ Frame 6FC1 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e43a0788007c81c88e5f2e2d37edf449a9a0adff50ab76c8cb5b1c8ae76f5860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:52:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 108917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13434
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:52:34 GMT

GET
H3-29 200 5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js Show response
pagead2.googlesyndication.com/bg/ Frame 7041 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5DoHiAB8gciOXy4tN-30Samgrf9Qq3bIy1sciudvWGA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e43a0788007c81c88e5f2e2d37edf449a9a0adff50ab76c8cb5b1c8ae76f5860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 18:52:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 108917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13434
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Jul 2022 18:52:34 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3085 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWZzyZ_8BYZSpGIyS3gOKl4PYDQAAAAA4AeAEAg&bg=!lJell9PNAAals0SOpbM7ACkAdvg8WuTCgUV8lU07GP_ukESuMYc7pXQMhuGWKIer7odAcomOnDYyDwIAAACpUgAAABFoAQcKABJJ4l8gl4OYLyOzA47Hj9nA1BqZAshYpk0oZxjOWbMC4ufh0a1yq--gfaCvcXCdkqu4Q6r17hTz7GoBE7rN93OxxsHFx2RjinfvFDcJft0qsW211fH0lGatIaNinSIQAbz5DvQX_RdyZB92ZP6Lh-rJTGE3Moy1CElg9FLhboG3D4IVfjA-xj-1dxfCossjp-5MAXfzbgamgtLsDZ5JDQrvb48CloJ7bPL7hMka3OFE7bU72N00lNuf56Vrb9es8UkcfENGGPFwEDV-J3otE5PAZJs5fNVmjNJ5US3OyVnY9RkbCf700wbMwWjQ7HdwowdOng8q_iCZ85rvHvaASd7-wX4d5zxYwoLLj28zJLWFgrUXFTc8TNgMPzdsZvG8KRlVPJA3TRu0A6k5tmPdUdw6gPYLCZpbKu5Hap0n3o0_l0I0l_dNDjMKaReQvnPeGdEaBSR5Z-ekVE1wSBGfQUXDxx79km1FrhO6bXl6mtDZX2sj3m6Iw-AdclBBrKapNwrFl490GZyJ_Mpap9LhiO64k_35nXvPyTSLyjO7bgMLB3P5QjYe2LDQg5-VEqv-QNU5-6nXnWFyRUjBXHR6LQygI4bYZxNN743AqFwps53ZhYiQGOm1OiWAKWf2_XRMAC7VhnupFwiC3FwWuj7iJ5APEeiwRCxIgYyOLkS88S6pUfEpLaVq19V5UGFOXUUifpkHjyPcMO2Q19oPCo-UvOJAPWNXZZrapsca7LNtbNc1pq9YFESp7i6rVicnQKwoDLtSALpaQRwZK11Mbp7rrtFjcft2RJjNPlAjckHX9a8RZXRIxgirhCbH5AHOHMFgdqu-YKk8svVVGbCQbKHKMBI6LARyk__mBccLCro3ryJy7xVwwZHCkoY5EqdSbJE8g0y0ITIdzdBfmjdMzVkIaST91MxsexadqRZBKy5_dSyTyJXq0PrXoBjghMGIHQB2kdJOsDqDjT5IAVrRg15-

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6FC1 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BS4wOZ_8BYcHgHMH33wPKnqeQCQAAAAA4AeAEAg&bg=!VValVhLNAAals0SOpbM7ACkAdvg8WnrilTH7MQuknJdMXjlOmMjr425juBytagzmNHwVn08VPvVEHgIAAAB8UgAAAApoAQeZAse_ndq6UPifWDlFdV8knIib3sPe5NdJ2U3YveYi7ZCqpyWjqeOB2jGSLa5VUWGrguZ3JOMs7b1VM5ves_GBnfZlDih56D1VjCjADusoJ6ORnwV8xwLs4lHLwVLzYg1Ol_RlUlnKrTOdc-wr9-Uol37-pjejdDM45Poe7YegFAPmrRYzulourUg-qyHpXtI9en3P0WzIVlNeg6YaERGSTPnNSCaLoF8PgGnMMlbJh68xRIb5NAYpApU-ec1DDvYqvaYfNBQzVFakKOygYKUDJf21Zbxs2UQ-_6iApjCljqPsWByYtXcZMUGFNLkws54Q0G68lA29afH_rPNE9ieRT4JoTnwegsf1qlkworINZrUmcftlYE4d60-eKLxrlI39jEn3yEx3trW993w3NqYr0y-Y7ya15xG_AVMfAtsLEKTuViKIL9wv2EILGSjXbhjstUHT3Spwp-BT4fQYY3z3OC0jC1lT31yOlgyuN0BNKtYh-qpWm82jK6epYjq_POgyBVQ4v7__Wv2vIOwZeRSeDYDeSs_vaa50dz4Qt10kG4jRhbutRB_o5EUVhFoY1VYZI5C05NYcI3WjB6o96kkasjehQNin_74U-RokchtdrlM6-573ooZVEqvRXRe4fim5uHYSc3fDD97KRZs1GMmhjqpTkpYnhDwGPRcT4nwnhfuLo32ACutIarh403XKxbJjkB_hLH8IPQK9NyCZf-VO4y11XQ3Wulfen275evZnuORmEg1SioBASkH4iGS7f1TY9fpZ6lxk4rZfYHcwygrbZ5M4uHBKJzWyhEr-HA2uFc9P_AA7Jt6c-g26hu1Cp9dLhBXaYF9XzhrqBIvY6C8dCv_iMAHYZLJAWwedQM76QREs971wbRUSDV7Csxwv_ZL8NmNJrtERBLEmFGu49IfGUK50ZeI81zRBHTrgnCk0ok86ULcs_IuAKOY

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7041 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BbkBNZ_8BYfWmHpbL7_UP9NW8wA0AAAAAOAHgBAI&bg=!xcalxoLNAAals0SOpbM7ACkAdvg8WvbfrdkVBzalaOHXa2mFTo3ZOLxutdTP9gp_zK4Wdns0tMURqAIAAABpUgAAAA1oAQcKAGxiLMOdIFPW1b4pHAOWZvjx1vFdps23fdPjc9LUKRVQZL2iOzW4181mvedWviul_ZWqhe5nTeLL17A7qMf6WZvw2fUi3_XflwHJRATsYlaSGqmb4fQ0fyC4A9BswvOZvExL8V0MuThVH-3hiyOZAtbTiiJ6RolqhFqKIgHTpKxpwLXsWx7DotciBxXBURk4PgqJjNuSmhw2JQCOEVNVZiMgR9DxzyLMCuomE7CLCrgKsUnzKBA91Mx2xmZM-I72nbL8BLShsa-bCTzLGN2zqQQ50VR223s9I5m1rkZvw27THtHH8gsenFkHoO0h201h8rIvn497q7IJQbwv6vxGRvOqzYNSIJNIsvlelUiUgy3dyueDOPFCOrQY8EqOvY0_EiIiZcgB1RqDWnNiNw5Pm-RJq_GrUIEV5oOhgmqbXSvZvy2tVccgZDJjA6yu8_oNWJ2Mnd45k2aVmwWHSMGIo3jEgQfcvVrlaaS6q0M1oZX4IQyP27QGbp3djPCglsjMmtcqmHEgNfNvM1tQQXGZWhQxD2JlM4jXGeu-HMegVPGjIjpu1Haf52YeCtamvFYSnAl2ihFMJeVVTYCg0HPZ7kyZrOTjzIwf2i5uiTGDCJ071X4tFhFNc77t2Wzf-P46Ar1bdCZeFh73yEsnqecxWjATr6lr9w4lIDE3pt_TeU_9qtmSMGLdf761ar-Pt3zQOknmPzA5JWGgxlDY11zORqUZP7UIUDDcvWEFa0ck6YiBgW8HauUTWYHAdFcU8Iju9oaLSfIafo0OLwBIpSI4qVa0NYPzpX5UdwycIDA6Hld8RbsnxSD_BgRcLV62wAEnwhOkPb7h1Fo-rxR9QU82bsIreY35zPsdB8SX8OTllgfbpyg1r8_gFXuRqpomoSF1SzHCighUgBvbDvrkX6Su9BO3mVSN1Gva94D2Z0Dd2EF-xN9U17brORvvkWwbF1sfUO_boAZHnroJ9vMCN7IVEGeHn6rrmjSw60kuZDp6xRaDVPpQI8uKAvthJ9K8HjjVwUK_gRdqQknuwZkM7ubEQCDCRDIGWKAUKLx-cSMOdRvIMbKFrToMEePqe7Nfncl9tPf-rN-tbpM8XGx-SMJX3KCvBEsjBM0

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 93BD 442 B
921 B 159ms
68ms Script
text/javascript 54.72.224.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=24909700008367800719594011670015&t=js&wid=tt-4635f7
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.224.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6cb4f37770cefa3f8c0b3b200660c779bd2893246235474f91ce2c0eda748d3c

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H/1.1 200
OK request_content.php Show response
hal900015.redintelligence.net/ Frame 9DED 8 KB
3 KB 1098ms
28ms Document
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=22fc3208dc&subid=&uid=7cd9c85f309f2c08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1VOgZ_8BYYLLA9fU7_UPnqax4A7isNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Q9Le486AgMy3LQ_4sOSXlzAMxG7uIfSmUKos1SC7hpgJZTwgSfJKTrVWRXGfqAiuAwHMxaIhDunGbgFAwy2db1lWIsAZJ6cKsmJXpS5RnsVJRH3qxQkdmzS2qRppWyTJNXNJp6LR2M-_2GZMv4aaFZTeNhJiGGaz9Ybh1KJreSqsGPGA0jI1jYLTBGICDShWxyxXDQkigpApBQ678EnmLQvbqoAOZfiNmFmOLCwCugbjMolgnyGxBZlJXkqrOkNzKjSU7qKclWYN7FuPvwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRokQ38ZjzMIcTwAw-TI64vlg%26sig%3DAOD64_0qMqBWafjk-aMYwJesiTd-lU8RHQ%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-D7g7YRBKNyo_kKXbgt3QIw-g8zDTZhDezH-FLHYp4pmVMY0sT0vBWgsUMKZd5Xtw9IdKtJwKpqY2uxugx_fMXw7VnHRZN3E7ZSLdeABXlGFMt3t_Y132OwyMlDXLCXCLe88oyfzup10JgKIAQ5QXUIHx2HQw%26cry%3D1%26dbm_d%3DAKAmf-DVbNFjcPLf48Qlm7Vrykxqa92_7Lcz5C59jmAYUQU7k7JL7P1oGHxnsQsUqKByULhlVImKkr2mv7_QPC8C4hNhWqgZn_KOFzxUkHsWU1DSoF-g4h9FRsFDHJ5kU7r8trbqDOeoB2bQEQ_bqpgANxqeuzAV8mX_DUDWM_MTSO9TkNaJJjIjcJaA6aFMH-gmAr2z5T9wC6OikkwYW6ZpjRD1Mr4DeQnDCLwv1nmhUqxAToQLsUOrnkxyX6GfU8TlynsS2yjlDz0bZbGBeAAJ4wgr0BYaQJpPAXKhHUt_j78_Z-8tfTkKViq4TPIAP7QNN2CrEEe4aHswr7E5PVueyQGq2YGHvLYRQ02ClVtvC-Ogou1lB5rV2Z4QEkOBTjfzvpCAgYuquAN4HsReBJVLAnjSdduBN5AkI_Gbgk33W0LNLEW118jcU77e5CkcbiRpfCyiXWHB7a-Rbn5Hb1IXM8zfEXHsfQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=3780560379201&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c3d45bc2e6550b6910cd07918d7d24553528a980b5fa1b99925fe49180a784ea

Request headers

Host: hal900015.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=21d783071b6cde61
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

Date: Thu, 29 Jul 2021 01:07:53 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 29 Jul 2021 02:07:53 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2316
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3F8E 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 28 Jul 2021 11:56:19 GMT
expires: Thu, 29 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 47493
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 93BD 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e552420a82615f6a2f347bc3c8b7ac589f842cfa9c43f57795b8f847b97ffdff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 3F8E 0
136 B 305ms
20ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEG8VaCWpHUlch1GL0H7gUxI&google_cver=1&google_push=AYg5qPIp4oFAAcpPi4EWHDV8G-QjPdfcrymX71m54-_ds7tKjtmmQuyr5-ipg8zCZRncrOsq4b-Jkt09CLGJLe0ZmBWFv0-tbhsR
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
via: 1.1 google
alt-svc: clear

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3F8E
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEMhWb2kgS4axf0zRaYfOf8Q&google_cver=1&google_push=AYg5qPK4KQJ1h9SKMGYV8Lpq_6M-pIG4sK0ILT-NsdtB4ZAhkrXoUTOWyDms4nbPQjtW6ZPBxapzbPrc6WURYp...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPK4KQJ1h9SKMGYV8Lpq_6M-pIG4sK0ILT-NsdtB4ZAhkrXoUTOWyDms4nbPQjtW6ZPBxapzbPrc6WURYpmNzk...

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPK4KQJ1h9SKMGYV8Lpq_6M-pIG4sK0ILT-NsdtB4ZAhkrXoUTOWyDms4nbPQjtW6ZPBxapzbPrc6WURYpmNzk2IVkMRBt-2

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPK4KQJ1h9SKMGYV8Lpq_6M-pIG4sK0ILT-NsdtB4ZAhkrXoUTOWyDms4nbPQjtW6ZPBxapzbPrc6WURYpmNzk2IVkMRBt-2
Date: Thu, 29 Jul 2021 01:07:52 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3F8E
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESECqXZRtPygR2pHc12G2ES_w&google_cver=1&google_push=AYg5qPLqOFGEWZGRS-zAGQXcdHW-jmD2WsMK3nqUT6G_kefUz4EUVjj7PAuYo3uChSU968Nv1CYCtSU4D9qLzXlH...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=biWR80wkRbyvr9OgXUxGRg2&google_push=AYg5qPLqOFGEWZGRS-zAGQXcdHW-jmD2WsMK3nqUT6G_kefUz4EUVjj7PAuYo3uChSU968Nv1CYCtSU4D9qLzXlHy5oTcspWboD9

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=biWR80wkRbyvr9OgXUxGRg2&google_push=AYg5qPLqOFGEWZGRS-zAGQXcdHW-jmD2WsMK3nqUT6G_kefUz4EUVjj7PAuYo3uChSU968Nv1CYCtSU4D9qLzXlHy5oTcspWboD9

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 29 Jul 2021 01:07:52 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=biWR80wkRbyvr9OgXUxGRg2&google_push=AYg5qPLqOFGEWZGRS-zAGQXcdHW-jmD2WsMK3nqUT6G_kefUz4EUVjj7PAuYo3uChSU968Nv1CYCtSU4D9qLzXlHy5oTcspWboD9
x-host: tde-deliveryengine-production-799d7ff85-h84xq
alt-svc: clear
content-length: 0

GET
H/1.1 403
Forbidden gg_pixel
sync.adaptv.advertising.com/ Frame 3F8E 14 B
14 B 1480ms
101ms Image
text/plain 52.73.9.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEAB4JwflZtaAjmlrtW22dr4&google_cver=1&google_push=AYg5qPLf30aCTfAztE16Jx7LeojTG9_b-3QQzBQaTrhJsav5s0lsGnT8uv0YI5LLViVj70sddLaouFWnn5F6MafTQJy9yP7HE84v
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.9.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: ribs2.0 /
Resource Hash: 0db80e4ae35fcf307507f9ced66fe9ccb3147c1ea12a60ea034092e6aa3ebf40

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 14
Content-Type: text/plain

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3F8E
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wih8yHt7TeuBtPuFWsvnyQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wih8yHt7TeuBtPuFWsvnyQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK82TWjSRVtHJKzEcZav9HmgCeDCOg4Cr2tRLDdDHnXd-oAwvuSIpwfEsPec6Vudh5ti5rmGb7LXJZUUfXVHfjD1gCT9son

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wih8yHt7TeuBtPuFWsvnyQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK82TWjSRVtHJKzEcZav9HmgCeDCOg4Cr2tRLDdDHnXd-oAwvuSIpwfEsPec6Vudh5ti5rmGb7LXJZUUfXVHfjD1gCT9son
date: Thu, 29 Jul 2021 01:07:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 204 exptsync
ads.yieldmo.com/ Frame 3F8E 0
35 B 1363ms
32ms Image
text/plain 99.80.189.205
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESECCPbMrPf4lAPp4Jvh6CttM&google_cver=1&google_push=AYg5qPI1HYzC4DEFH9cfxmn64zK8ogRKoGyoS0qS2fLuJ975Irqjc5bV7TzoYqaJ1D2kYe633gV4pd7-QpLqF2tKdGJm-wq8XPw
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.205 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3F8E
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEDwtdzgoQ7r0-De6P87wvDE&google_cver=1&google_push=AYg5qPI2iSvbTVCQOxJIoSxBXVanHfhC2sPdeuqMQ6bHXPFNWOCscwwvCEkaHnWkYn-ysW3v-pUOXSwTt3aNdHvGl...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MGFjNmYxNTYtZmY1MS00ZTczLWIzOTktMTZjODY5NGFkNDRk&google_push=AYg5qPI2iSvbTVCQOxJIoSxBXVanHfhC2sPdeuqMQ6bHXPFNWOCscwwvCEkaHnWk...

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MGFjNmYxNTYtZmY1MS00ZTczLWIzOTktMTZjODY5NGFkNDRk&google_push=AYg5qPI2iSvbTVCQOxJIoSxBXVanHfhC2sPdeuqMQ6bHXPFNWOCscwwvCEkaHnWkYn-ysW3v-pUOXSwTt3aNdHvGl0YdZsdb_rED3w

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MGFjNmYxNTYtZmY1MS00ZTczLWIzOTktMTZjODY5NGFkNDRk&google_push=AYg5qPI2iSvbTVCQOxJIoSxBXVanHfhC2sPdeuqMQ6bHXPFNWOCscwwvCEkaHnWkYn-ysW3v-pUOXSwTt3aNdHvGl0YdZsdb_rED3w
date: Thu, 29 Jul 2021 01:07:53 GMT
content-length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 3F8E 0
12 B 31ms
30ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ILNQcnH60qUOr2jslrenslUKCgG9pZas2CdlVFRwKwYRp0-O9E5pf4yY7tANuEYYSCmNTteQ

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

e6244d1a4401c7fe26622998bffa5f86940922.png
static.tradetracker.net/nl/material_image/f1/ Frame 93BD
Redirect Chain

https://ti.tradetracker.net/?c=34211&m=1888189&a=70002&r=24909700008367800719594011670015&t=html
https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png

2 KB
2 KB

68ms
31ms

Image
image/png

2600:9000:2190:4a00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:4a00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a82269bce61196e0aca1c36b304de3471e367a41179284996e6b06b2a3b3009a

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:03:48 GMT
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
last-modified: Fri, 23 Apr 2021 10:05:11 GMT
server: nginx
age: 244
etag: "60829bd7-6cf"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 1743
x-amz-cf-id: gMkh9idoC4EnZHOjoUz1rivElJEnB3vZdMn-7JFIlcjpxrvj5xF08w==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/f1/e6244d1a4401c7fe26622998bffa5f86940922.png
date: Thu, 29 Jul 2021 01:07:52 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request.php Show response
hal90001.redintelligence.net/ Frame B236 2 KB
1 KB 1164ms
96ms Script
application/x-javascript 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=d2a3459075&subid=&uid=aede5d44fd12eb66&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmeNrZ_8BYaPHA-yK7_UPyfKYkAvisNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Qm66rC2kEtUMElnscC_Qv_NBut9Z6bFl5FWoPSJEDPoI1SEUYhrjN9LORhpAaAfOtc6QfG3VAvTq7b9CIX7btBBJPjLlLCgqxgcUZZezUyjEugpVGCdrs11KHEDXDXVLNZn0VaF0bbJAmUYANSIIIg7HxKupvZa-7MzzWYPej_8JcXjztftKF58uhlFTzcsNcHBvTF9P6PNlBlfb9d3hfY9SG0Yq7d9uSHh2uK9xOD-N_nW0gyy-9EDFjcAfi0ULYcjim3XJ_Aa4AU9ulwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoR2tLErkIVeyGs7h0dkeeZw%26sig%3DAOD64_21gC56K3s7cY2PewagTEnOZbLPww%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-DDOVXZdT-ILmv2kKHXpBcwvQ_bLjoyExKjt5RZ1awZO0kcujs5R9qF69HiSO0Ol-qOW0xUCJkO1-oR3iA9qRfaPJN206OOGppxjW35rokLr8EL56ykYwHrVxTHl0FikBNXcz0rZDAe_BHDWlgUluFslIcskQ%26cry%3D1%26dbm_d%3DAKAmf-Au2Tk4CnIBSvn_tWBP2PLDx6nMnINUCirJY2Xm9behVOm8NZBkfIUuSjI10SD_o23Zp_hMxFFyk3JPPodgq3RKjCBrddllJuK179Vi0RhEEd5ZZvQMLpUOgeZYzjrlzuu9R_javhFj-8_hx5G3__tr7d1cXxnC3oyIA_rzOc9tYZUNuszmcmi-DKiM41FhNT8_6mRWGYApncIBBsEZX2aA_0bgqJbTOBhbPVk8PvsO5bIx9HetvWy5nE4592-6L2GpkUkBhepQvKxKg_4UTfBZZsFeU_AcNL1nEJIuOAsSnVvAIP1hfuszl3p_klypJ3flUn3h_FoOBmqZhtMK7AV-dhDSHkMIFaM8dA2yTBjSLIw3HVDYxOOwW8S6YQDrBo_yyjvQHlnJFnRun8gf4BNhxOtFtPlDyit3FtODuK3m16HJUofkQK1nETFJUmjL5FDR-Kzy-3msIWINPsn2eL0r1qu8JQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9839990116955&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/mu72dqmlk6df?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmeNrZ_8BYaPHA-yK7_UPyfKYkAvisNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Qm66rC2kEtUMElnscC_Qv_NBut9Z6bFl5FWoPSJEDPoI1SEUYhrjN9LORhpAaAfOtc6QfG3VAvTq7b9CIX7btBBJPjLlLCgqxgcUZZezUyjEugpVGCdrs11KHEDXDXVLNZn0VaF0bbJAmUYANSIIIg7HxKupvZa-7MzzWYPej_8JcXjztftKF58uhlFTzcsNcHBvTF9P6PNlBlfb9d3hfY9SG0Yq7d9uSHh2uK9xOD-N_nW0gyy-9EDFjcAfi0ULYcjim3XJ_Aa4AU9ulwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoR2tLErkIVeyGs7h0dkeeZw%26sig%3DAOD64_21gC56K3s7cY2PewagTEnOZbLPww%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-DDOVXZdT-ILmv2kKHXpBcwvQ_bLjoyExKjt5RZ1awZO0kcujs5R9qF69HiSO0Ol-qOW0xUCJkO1-oR3iA9qRfaPJN206OOGppxjW35rokLr8EL56ykYwHrVxTHl0FikBNXcz0rZDAe_BHDWlgUluFslIcskQ%26cry%3D1%26dbm_d%3DAKAmf-Au2Tk4CnIBSvn_tWBP2PLDx6nMnINUCirJY2Xm9behVOm8NZBkfIUuSjI10SD_o23Zp_hMxFFyk3JPPodgq3RKjCBrddllJuK179Vi0RhEEd5ZZvQMLpUOgeZYzjrlzuu9R_javhFj-8_hx5G3__tr7d1cXxnC3oyIA_rzOc9tYZUNuszmcmi-DKiM41FhNT8_6mRWGYApncIBBsEZX2aA_0bgqJbTOBhbPVk8PvsO5bIx9HetvWy5nE4592-6L2GpkUkBhepQvKxKg_4UTfBZZsFeU_AcNL1nEJIuOAsSnVvAIP1hfuszl3p_klypJ3flUn3h_FoOBmqZhtMK7AV-dhDSHkMIFaM8dA2yTBjSLIw3HVDYxOOwW8S6YQDrBo_yyjvQHlnJFnRun8gf4BNhxOtFtPlDyit3FtODuK3m16HJUofkQK1nETFJUmjL5FDR-Kzy-3msIWINPsn2eL0r1qu8JQ%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: b23449f2da5c439f96d0c25536d6b7e538c2641e72d0e5d5c1432c5f09dce901

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:53 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 90997400008025500719594011670001
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 768
Expires: Thu, 29 Jul 2021 02:07:53 +0200

GET
H/1.1 200
OK request.php Show response
hal90007.redintelligence.net/ Frame 00FA 3 KB
2 KB 3224ms
105ms Script
application/x-javascript 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=2198faa5f1&subid=&uid=8d1bf59cf14219af&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9868186286741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/mu72dqmlk6df?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9740ffebe58e181786af9079461d1fd4c7b746ef320b84b69aef3b248c03be49

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:55 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 14851400008044200719594011670007
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1038
Expires: Thu, 29 Jul 2021 02:07:55 +0200

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
66 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODYifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:51 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzMwOTI3OTcwOTc0NTQ0NCIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLW1lZHJlY3RhbmdsZS0xLTBfMiIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:50 UTC

GET
H2 200 army.gif Show response
g.ezoic.net/porpoiseant/ 0
20 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODY4MzAwNjE5OTcxMTUwOSIsImRvbWFpbl9pZCI6IjE5NDcxIiwidW5pdCI6ImRpdi1ncHQtYWQtcmFua3NheXNfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjI3NTIwODY1LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6Ik5MIiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijg2ODMwMDYxOTk3MTE1MDkiLCJkb21haW5faWQiOiIxOTQ3MSIsInVuaXQiOiJkaXYtZ3B0LWFkLXJhbmtzYXlzX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTYyNzUyMDg2NSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJOTCIsInBhZ2V2aWV3X2lkIjoiNmUzYzljZGUtYmIzMC00MDM3LTY4NTgtOTdkOTI0MmZlNmIwIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4NjgzMDA2MTk5NzExNTA5IiwiZG9tYWluX2lkIjoiMTk0NzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1yYW5rc2F5c19jb20tYm94LTQtMCIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiTkwiLCJwYWdldmlld19pZCI6IjZlM2M5Y2RlLWJiMzAtNDAzNy02ODU4LTk3ZDkyNDJmZTZiMCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjAsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODUifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:52 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:51 UTC

GET
H2 200 css
fonts.googleapis.com/ Frame 9DED 4 KB
744 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:18:48 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:53 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9DED 12 KB
12 KB 29ms
28ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/53619/creativesup/img220807_banners_megekko_affiliate_image_v2-1597759923086-min%20(2).jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 56f88fa8fcc12a0abe41b6467044a2717c0b1923f32ad2fc5d9ac078c7087091

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:53 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 11775
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900015.redintelligence.net/ Frame 9DED 0
150 B 105ms
36ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/viewability?s=24909700008367800719594011670015&a=74503fc1&vb=m
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:53 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 9DED 434 B
700 B 69ms
69ms Script
text/javascript 54.72.224.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=24909700008367800719594011670015&t=js&wid=tt-877271
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.224.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bef9227e0b01b5386b73fc4fbeb30273210280219f277f8fb886206ec947b64e

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H2 200 / Show response
ti.tradetracker.net/ Frame 9DED 457 B
723 B 73ms
72ms Script
text/javascript 54.72.224.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=&r=24909700008367800719594011670015&t=js&wid=tt-19aa54
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.224.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3815f1b89303ea578a81a4c566f9c401f39c219fb6d4af297effc2dfc5b9d7f5

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
cache-control: no-cache, must-revalidate
expires: Mon, 26 Jul 1997 05:00:00 GMT
server: nginx
content-type: text/javascript; charset=UTF-8

GET
H3-29 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 9DED 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900015.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 17:54:23 GMT
x-content-type-options: nosniff
age: 198810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:54:23 GMT

GET
H3-29 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 9DED 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900015.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 13:27:21 GMT
x-content-type-options: nosniff
age: 128432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 13:27:21 GMT

GET
H2

200

1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
static.tradetracker.net/nl/material_image/49/ Frame 9DED
Redirect Chain

https://ti.tradetracker.net/?c=558&m=24180&a=70002&r=24909700008367800719594011670015&t=html
https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg

13 KB
13 KB

30ms
30ms

Image
image/jpeg

2600:9000:2190:4a00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:4a00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d731e6d3e38558377e2fa974639cabf5209d9cafa5f00e186b0e3faf0aea02b

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
last-modified: Thu, 16 Mar 2017 08:27:46 GMT
server: nginx
x-amz-cf-pop: ZRH50-C1
etag: "58ca4c82-335a"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 13146
x-amz-cf-id: 82998MEA2uOL5ZjWATkEI8SeCK_SSXrNwBMseyJ_3d-eqf6F1tMoaw==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/49/1f21095a5f4ae3c95070194bad8a5ad919a00b.jpg
date: Thu, 29 Jul 2021 01:07:53 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
static.tradetracker.net/nl/material_image/6b/ Frame 9DED
Redirect Chain

https://ti.tradetracker.net/?c=29026&m=1463044&a=70002&r=24909700008367800719594011670015&t=html
https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif

18 KB
18 KB

50ms
49ms

Image
image/gif

2600:9000:2190:4a00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=24909700008367800719594011670015&a=86f2ae65
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:4a00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfdcc9934068e5000d8b906423558878e7cd1b9a6b7b1d566a30a6f969ee71f

Request headers

Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
last-modified: Mon, 26 Nov 2018 13:16:08 GMT
server: nginx
x-amz-cf-pop: ZRH50-C1
etag: "5bfbf218-4653"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 18003
x-amz-cf-id: YnKsAKEfp5K3fQTbotK1g1FmeWEYTWL6JGOHDI02_5hBEAuJyxM1AA==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/6b/d4fbe93890fb48767a755f66b5fd1571de5cf9.gif
date: Thu, 29 Jul 2021 01:07:53 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 greenoaks.gif Show response
g.ezoic.net/detroitchicago/ 0
66 B 24ms
24ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTNjOWNkZS1iYjMwLTQwMzctNjg1OC05N2Q5MjQyZmU2YjAiLCJkb21haW5faWQiOiIxOTQ3MSIsInRfZXBvY2giOjE2Mjc1MjA4NjUsImRhdGEiOlt7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjM0MjI0MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMjEzOSJ9XX1d
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/memphis.js?gcb=195-1&cb=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ranksays.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.ranksays.com
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 28 Jul 2021 01:07:52 UTC

GET
H/1.1 200
OK Cookie set cshow.php Show response
www.awin1.com/ Frame 710E 43 B
701 B 106ms
57ms Document
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2824569&v=9247&q=407742&r=235229&pref1=90997400008025500719594011670001&pv=1

Requested by

Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=d2a3459075&subid=&uid=aede5d44fd12eb66&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmeNrZ_8BYaPHA-yK7_UPyfKYkAvisNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Qm66rC2kEtUMElnscC_Qv_NBut9Z6bFl5FWoPSJEDPoI1SEUYhrjN9LORhpAaAfOtc6QfG3VAvTq7b9CIX7btBBJPjLlLCgqxgcUZZezUyjEugpVGCdrs11KHEDXDXVLNZn0VaF0bbJAmUYANSIIIg7HxKupvZa-7MzzWYPej_8JcXjztftKF58uhlFTzcsNcHBvTF9P6PNlBlfb9d3hfY9SG0Yq7d9uSHh2uK9xOD-N_nW0gyy-9EDFjcAfi0ULYcjim3XJ_Aa4AU9ulwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoR2tLErkIVeyGs7h0dkeeZw%26sig%3DAOD64_21gC56K3s7cY2PewagTEnOZbLPww%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-DDOVXZdT-ILmv2kKHXpBcwvQ_bLjoyExKjt5RZ1awZO0kcujs5R9qF69HiSO0Ol-qOW0xUCJkO1-oR3iA9qRfaPJN206OOGppxjW35rokLr8EL56ykYwHrVxTHl0FikBNXcz0rZDAe_BHDWlgUluFslIcskQ%26cry%3D1%26dbm_d%3DAKAmf-Au2Tk4CnIBSvn_tWBP2PLDx6nMnINUCirJY2Xm9behVOm8NZBkfIUuSjI10SD_o23Zp_hMxFFyk3JPPodgq3RKjCBrddllJuK179Vi0RhEEd5ZZvQMLpUOgeZYzjrlzuu9R_javhFj-8_hx5G3__tr7d1cXxnC3oyIA_rzOc9tYZUNuszmcmi-DKiM41FhNT8_6mRWGYApncIBBsEZX2aA_0bgqJbTOBhbPVk8PvsO5bIx9HetvWy5nE4592-6L2GpkUkBhepQvKxKg_4UTfBZZsFeU_AcNL1nEJIuOAsSnVvAIP1hfuszl3p_klypJ3flUn3h_FoOBmqZhtMK7AV-dhDSHkMIFaM8dA2yTBjSLIw3HVDYxOOwW8S6YQDrBo_yyjvQHlnJFnRun8gf4BNhxOtFtPlDyit3FtODuK3m16HJUofkQK1nETFJUmjL5FDR-Kzy-3msIWINPsn2eL0r1qu8JQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9839990116955&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.awin1.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Thu, 29 Jul 2021 01:07:53 GMT
Connection: keep-alive
Set-Cookie: awpv9247=235229|1627520873|67123330-f009-11eb-bfe3-692d0dec5663;domain=.awin1.com;path=/;expires=Sunday, 01-Aug-2021 01:07:53 UTC;Secure;SameSite=None AWSESS=407742:2824569;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H/1.1 200
OK request_content.php Show response
hal90001.redintelligence.net/ Frame 09AA 7 KB
2 KB 94ms
32ms Document
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=d2a3459075&subid=&uid=aede5d44fd12eb66&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCmeNrZ_8BYaPHA-yK7_UPyfKYkAvisNzwX76z1PuJC_AuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_Qm66rC2kEtUMElnscC_Qv_NBut9Z6bFl5FWoPSJEDPoI1SEUYhrjN9LORhpAaAfOtc6QfG3VAvTq7b9CIX7btBBJPjLlLCgqxgcUZZezUyjEugpVGCdrs11KHEDXDXVLNZn0VaF0bbJAmUYANSIIIg7HxKupvZa-7MzzWYPej_8JcXjztftKF58uhlFTzcsNcHBvTF9P6PNlBlfb9d3hfY9SG0Yq7d9uSHh2uK9xOD-N_nW0gyy-9EDFjcAfi0ULYcjim3XJ_Aa4AU9ulwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoR2tLErkIVeyGs7h0dkeeZw%26sig%3DAOD64_21gC56K3s7cY2PewagTEnOZbLPww%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-DDOVXZdT-ILmv2kKHXpBcwvQ_bLjoyExKjt5RZ1awZO0kcujs5R9qF69HiSO0Ol-qOW0xUCJkO1-oR3iA9qRfaPJN206OOGppxjW35rokLr8EL56ykYwHrVxTHl0FikBNXcz0rZDAe_BHDWlgUluFslIcskQ%26cry%3D1%26dbm_d%3DAKAmf-Au2Tk4CnIBSvn_tWBP2PLDx6nMnINUCirJY2Xm9behVOm8NZBkfIUuSjI10SD_o23Zp_hMxFFyk3JPPodgq3RKjCBrddllJuK179Vi0RhEEd5ZZvQMLpUOgeZYzjrlzuu9R_javhFj-8_hx5G3__tr7d1cXxnC3oyIA_rzOc9tYZUNuszmcmi-DKiM41FhNT8_6mRWGYApncIBBsEZX2aA_0bgqJbTOBhbPVk8PvsO5bIx9HetvWy5nE4592-6L2GpkUkBhepQvKxKg_4UTfBZZsFeU_AcNL1nEJIuOAsSnVvAIP1hfuszl3p_klypJ3flUn3h_FoOBmqZhtMK7AV-dhDSHkMIFaM8dA2yTBjSLIw3HVDYxOOwW8S6YQDrBo_yyjvQHlnJFnRun8gf4BNhxOtFtPlDyit3FtODuK3m16HJUofkQK1nETFJUmjL5FDR-Kzy-3msIWINPsn2eL0r1qu8JQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9839990116955&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 9bd84110c1dc83d115940b8ef1fee4354c8ff02f72d70ab24774fa2e788ffdf0

Request headers

Host: hal90001.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=21d783071b6cde61
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

Date: Thu, 29 Jul 2021 01:07:53 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 29 Jul 2021 02:07:53 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2088
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame B236 43 B
702 B 163ms
57ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2708634&v=20834&q=396798&r=235229&pref1=90997400008025500719594011670001&pv=1

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:54 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7A3C 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 28 Jul 2021 11:56:19 GMT
expires: Thu, 29 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 47494
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame B236 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 545dcaa225bafb2cda1bd40c0888a9decca4f98fea6da411b93afe140d6abdbf

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGh6oCbIV4pLqdmYPsLAKO0&google_cver=1&google_push=AYg5qPL9Trvde2Ok66jA20eVZyLWXHnDdeS3-MP0qnSo4sP9tAUUrEnpqLzFlk7V3p2hUbiQXJ9yA5qb0TKQ0DfJ4tRgv0u9peI
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NUE3RDU5OTQ3MERBNDUwRQ==

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NUE3RDU5OTQ3MERBNDUwRQ==

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NUE3RDU5OTQ3MERBNDUwRQ==
date: Thu, 29 Jul 2021 01:07:54 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEECEGJZlBfc_8Yyoc0nSpnw&google_cver=1&google_push=AYg5qPKo4I_DMZEJOVySVmyCs3iQ5dMDch2B0N9oKC4tOlV3GmiRQuUyteSqKc2NqRY1XcJpZO1Hz8JoEe76NNCKHljd...
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
https://x.bidswitch.net/sync?dsp_id=59&user_id=96694d11-3372-4a28-86c4-46c21a6f7ede&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKo4I_DMZEJOVySVmyCs3iQ5dMDch2B0N9oKC4tOlV3GmiRQuUyteSqKc2NqRY1XcJpZO1Hz8JoEe76NNCKHljd-nMxupE&google_hm=bik0Q6ySS46X0bxHnZg4NA==

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKo4I_DMZEJOVySVmyCs3iQ5dMDch2B0N9oKC4tOlV3GmiRQuUyteSqKc2NqRY1XcJpZO1Hz8JoEe76NNCKHljd-nMxupE&google_hm=bik0Q6ySS46X0bxHnZg4NA==

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKo4I_DMZEJOVySVmyCs3iQ5dMDch2B0N9oKC4tOlV3GmiRQuUyteSqKc2NqRY1XcJpZO1Hz8JoEe76NNCKHljd-nMxupE&google_hm=bik0Q6ySS46X0bxHnZg4NA==
date: Thu, 29 Jul 2021 01:07:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEFF-MKflXCkr0j71Jlsje-g&google_cver=1&google_push=AYg5qPLGvTHwMeHt17iqevcqK-PmdvHkCUQExMjE7PKkcDLhvYhkOqW1TWDNk-xl9iBep6IfhyS5637Gz-V7c359OwxMIhkFZg
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEFF-MKflXCkr0j71Jlsje-g&google_cver=1&google_push=AYg5qPLGvTHwMeHt17iqevcqK-PmdvHkCUQExMjE7PKkcDLhvYhkOqW1TWDNk-xl9iBep6IfhyS5637Gz-V7c359OwxMI...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLGvTHwMeHt17iqevcqK-PmdvHkCUQExMjE7PKkcDLhvYhkOqW1TWDNk-xl9iBep6IfhyS5637Gz-V7c359OwxMIhkFZg

170 B
188 B

33ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLGvTHwMeHt17iqevcqK-PmdvHkCUQExMjE7PKkcDLhvYhkOqW1TWDNk-xl9iBep6IfhyS5637Gz-V7c359OwxMIhkFZg

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLGvTHwMeHt17iqevcqK-PmdvHkCUQExMjE7PKkcDLhvYhkOqW1TWDNk-xl9iBep6IfhyS5637Gz-V7c359OwxMIhkFZg
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEDG883NJox9cRWlJAFKDW8&google_cver=1&google_push=AYg5qPLrS6Uheuul1RmHp_Y7uhDeGz7Q9l9rf2NKFI37RgUqhOJRXIL0w8dxH6y_YM_MK1or4yS...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JPN1dOR0ItMUItQjNKWA==&google_push=AYg5qPLrS6Uheuul1RmHp_Y7uhDeGz7Q9l9rf2NKFI37RgUqhOJRXIL0w8dxH6y_YM_MK1or4ySCIovm5t92DseBb4dK0MNBF6Q

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JPN1dOR0ItMUItQjNKWA==&google_push=AYg5qPLrS6Uheuul1RmHp_Y7uhDeGz7Q9l9rf2NKFI37RgUqhOJRXIL0w8dxH6y_YM_MK1or4ySCIovm5t92DseBb4dK0MNBF6Q

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JPN1dOR0ItMUItQjNKWA==&google_push=AYg5qPLrS6Uheuul1RmHp_Y7uhDeGz7Q9l9rf2NKFI37RgUqhOJRXIL0w8dxH6y_YM_MK1or4ySCIovm5t92DseBb4dK0MNBF6Q
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 7A3C 0
478 B 1087ms
16ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAYg5qPLv8eu75RZ4kOlqLdpnOYU6mBkUmnOI4d4YFFlFZuBF33A-xEAzrszXGgZwH-_a-kYe6TL_8VZtGDQQG3hBlbLJ2lLlyao%26google_hm%3D%5BUID%5D&google_gid=CAESEFogCXVQ8Cbo1DezYdbZYZg&google_cver=1

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Madrid, Spain, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:54 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEG4x1ravZwWnqRj_-PkykgY&google_cver=1&google_push=AYg5qPKNEIbc-bL7S3wbLNk7VbeHL0-8rRP2ix1rtvH0ckJWk4P69oZjGIsLggkEp9IDjSjNQELUyztHlCxgqLK2BDCJewp5QCc
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPKNEIbc-bL7S3wbLNk7VbeHL0-8rRP2ix1rtvH0ckJWk4P69oZjGIsLggkEp9IDjSjNQELUyztHlCxgqLK2BDCJewp5QCc&googl...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTY4Nzg3NjQ5NTc5MzkzNTYxNzA%3D&google_push=AYg5qPKNEIbc-bL7S3wbLNk7VbeHL0-8rRP2ix1rtvH0ckJWk4P69oZjGIsLgg...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTY4Nzg3NjQ5NTc5MzkzNTYxNzA%3D&google_push=AYg5qPKNEIbc-bL7S3wbLNk7VbeHL0-8rRP2ix1rtvH0ckJWk4P69oZjGIsLggkEp9IDjSjNQELUyztHlCxgqLK2BDCJewp5QCc

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTY4Nzg3NjQ5NTc5MzkzNTYxNzA%3D&google_push=AYg5qPKNEIbc-bL7S3wbLNk7VbeHL0-8rRP2ix1rtvH0ckJWk4P69oZjGIsLggkEp9IDjSjNQELUyztHlCxgqLK2BDCJewp5QCc
date: Thu, 29 Jul 2021 01:07:55 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 7A3C
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEHQKg6DDpSAeOlJfCAItNI0&google_cver=1&google_push=AYg5qPL4G1YLiStZXZ292t9keYX46x-cz69kpTHg4cSXuxeOpQ5S6i9VVDDiP6OksiUeNrIOr6JMf-E5RhhhhVAFE...
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3D9ef0798e-bfea-48eb-bfb4-500476486a8a%26google_push%3DAYg5qPL4G1YLiStZXZ292t9keYX46x-...
https://tech.rtb.mts.ru/?dsp_uid=9ef0798e-bfea-48eb-bfb4-500476486a8a&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3D9ef0798e-bfea-48eb-bfb4-500476486a8a%26g...
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=9ef0798e-bfea-48eb-bfb4-500476486a8a&google_push=AYg5qPL4G1YLiStZXZ292t9keYX46x-cz69kpTHg4cSXuxeOpQ5S6i9VVDDiP6OksiUeNrIOr6JMf-E5RhhhhVAF...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=9ef0798e-bfea-48eb-bfb4-500476486a8a&google_push=AYg5qPL4G1YLiStZXZ292t9keYX46x-cz69kpTHg4cSXuxeOpQ5S6i9VVDDiP6OksiUeNrIOr6JMf-E5RhhhhVAFE3JTD9Vs_lM

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 29 Jul 2021 01:07:55 GMT
Server: nginx/1.13.12
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=9ef0798e-bfea-48eb-bfb4-500476486a8a&google_push=AYg5qPL4G1YLiStZXZ292t9keYX46x-cz69kpTHg4cSXuxeOpQ5S6i9VVDDiP6OksiUeNrIOr6JMf-E5RhhhhVAFE3JTD9Vs_lM
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 7A3C 0
12 B 30ms
29ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JIFO2dOVTLdF0CbzaMKQ26s9NTpVYbl0mXra8tgnk--QhtzMYc9rmrolV6m6G3Be7DGSBTng

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 css
fonts.googleapis.com/ Frame 09AA 4 KB
648 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 00:18:48 GMT
server: ESF
date: Thu, 29 Jul 2021 01:07:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Jul 2021 01:07:53 GMT

GET
H2

200

43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
static.tradetracker.net/nl/material_image/9a/ Frame 09AA
Redirect Chain

https://ti.tradetracker.net/?c=4693&m=1371425&a=70002&r=90997400008025500719594011670001&t=html
https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif

6 KB
6 KB

30ms
30ms

Image
image/gif

2600:9000:2190:4a00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:4a00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1a2748bc84c0cdf421b952cc9a8c32ff0024c463c254b1cbbdd5ef6368bfff74

Request headers

Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 01:07:17 GMT
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
last-modified: Thu, 28 Jun 2018 08:43:53 GMT
server: nginx
age: 37
etag: "5b349fc9-16b8"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 5816
x-amz-cf-id: en-iWo2IbImPkJ_Zwc8nsK_ZJD98lbohb1GHajR177QLUf4Mn5cI7g==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
date: Thu, 29 Jul 2021 01:07:54 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 09AA 13 KB
13 KB 429ms
115ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55739/creativesup/boxspring-xxl-modern-setting-1-1200x627.jpg
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 349459944a0c388d6a907f9575a4b6dfa9d0b8145a4a38b595d8233be14b7ca9

Request headers

Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:54 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12742
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 09AA 14 KB
14 KB 1190ms
116ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/57777/creativesup/1200x627.jpg
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: ec74a1c5e76f396a7d535f23af850bb7e20e2818aba91d97b3400d8fe4a2258f

Request headers

Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:55 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14081
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal90001.redintelligence.net/ Frame 09AA 0
150 B 95ms
33ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/viewability?s=90997400008025500719594011670001&a=332fb677&vb=m
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90001.redintelligence.net/request_content.php?s=90997400008025500719594011670001&a=88c6fef7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 29 Jul 2021 01:07:54 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 09AA 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal90001.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 17:54:23 GMT
x-content-type-options: nosniff
age: 198810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 17:54:23 GMT

GET
H3-29 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 09AA 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal90001.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 13:27:21 GMT
x-content-type-options: nosniff
age: 128432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 13:27:21 GMT

GET
H2 200 / Show response
htlp.large.nl/ Frame A03B 3 KB
3 KB 52ms
7ms Document
text/html 2600:9000:20eb:1400:b:a286:7800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.large.nl/
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=2198faa5f1&subid=&uid=8d1bf59cf14219af&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9868186286741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1400:b:a286:7800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

:method: GET
:authority: htlp.large.nl
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

content-type: text/html
content-length: 2647
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
accept-ranges: bytes
server: AmazonS3
date: Thu, 29 Jul 2021 01:07:48 GMT
cache-control: max-age=10
etag: "81767a046d18dbeec7092a1dbdc70325"
x-cache: Hit from cloudfront
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: exmyflzdym_wAr2SjCFclvTDLBiSHk23B7tGFfBb4VeBs2uXu3r06w==
age: 8

GET
H/1.1 200
OK Cookie set cshow.php Show response
www.awin1.com/ Frame 72D5 43 B
701 B 53ms
52ms Document
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2739664&v=8462&q=320784&r=235229&pref1=14851400008044200719594011670007&pv=1

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=2198faa5f1&subid=&uid=8d1bf59cf14219af&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9868186286741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.awin1.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: awpv9247=235229|1627520873|67123330-f009-11eb-bfe3-692d0dec5663; awpv20834=235229|1627520874|671b0cd0-f009-11eb-bfe3-692d0dec5663; AWSESS=396798:2708634
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Thu, 29 Jul 2021 01:07:55 GMT
Connection: keep-alive
Set-Cookie: awpv8462=235229|1627520875|6844bfc0-f009-11eb-bfe3-692d0dec5663;domain=.awin1.com;path=/;expires=Sunday, 01-Aug-2021 01:07:55 UTC;Secure;SameSite=None AWSESS=320784:2739664;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 00FA 12 KB
12 KB 187ms
102ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=14851400008044200719594011670007&js=1&nw=1&cp=024714828
Requested by: Host: www.ranksays.com
URL: https://www.ranksays.com/siteinfo/shitkingz.jp
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: d4d8be0980eb67806cce372cae34546ce744c51207577f475c5d18242278d67a

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:56 GMT
Last-Modified: Thu, 29 Jul 2021 01:07:56 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame B87F 7 KB
2 KB 93ms
32ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=14851400008044200719594011670007&a=d30ee406
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=mu72dqmlk6df&nw=20&renderingType=javascript&namespace=2198faa5f1&subid=&uid=8d1bf59cf14219af&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCV_HxZ_8BYfjxA7mO7_UP54un0APisNzwX6v77-n3DPAuEAEg9PnGJWCRhICA7BfIAQmpAsK6SwAE37M-qAMBqgTOAU_QqhsixyNPPEgQ6MMISkcDpLaVRGZeN2-P9ljariXMdtutAXufdKHOJkbTwGBrfmn9CwNG4BbzdZO7XDEfXcFN1L2Ih5Q06uWUd5xPxKx_HdfBQwDBbES8WevBPKGeIAhgUuyyXHnnPWK00u41OTW8O0mX0lz3twpNdtFcFNtPUXVQ4QpKO8OXOh3H25ScndkHyw3Q-9Uwde1Gooi6Gp8oVVx3asZzV_zhxri4ExpB79Fy8doW40Wyt43RsxERI-566quqRIgp_RnSk6yfwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4NDkyMjA3NTc5MjY1MzOACgOYCwHICwGADAGwE5flsgrQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoZ-T2LfjuBnn1meUW-TD4Ng%26sig%3DAOD64_3CLowCefGd2-O6_fI1-H4Lyb47yw%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-B4NKqimijstDsBHAtPh1oA-YDb7bZo2b_Pkq9CWOC7QGWVlA1iBX81kM7vhMMCrWlOZsO2sITpPnLb8520Fl6wjUywQJQGhViaK3-HaVpCaRHfETsEru8MkolBXhiC3obdz34iYUVkxuvvFg9GO3sDr9G_4A%26cry%3D1%26dbm_d%3DAKAmf-DTBU8ivd-C-yHbicCo4S8eeYlMafY-oMdm2Uc-p3xpG3zTOgLaZZFd2GfnMyZSg6tEvs_4lTQL5dtwDtDD6po_7SoGJpXHwuCuFkxiDSx1DlIbDSeEbtQz4fZlMmL1jFbF5tk5FT7AF5qNEviNRKWAiGSpuD-6HL5oYhpGBn24wshvprEFEFdjnIfUdTsgZkY46kN3mqnlHd7tL_UwL4a4mipfxRUCGpXbJ6Ge_EJBqjIuhzSUlhJyTI19VGHjOOWLCjmtWUXGe7Qpfr6CncwYhY3exO6M3Z2ShcG0w-lLku8S_9i9X5z6vwzCmzNWyA964OBeE2XGkIq2bC9t0K-5oF0cbAqJFfpJ1Cktmpam_NM4XUWtgp0LdXiO8HXCGUhibj9xloj4aDW8Zi-hoze6ffkYe07WoOX4SM7Dz8NSTFQYJ8pC0GS90q-cTEywcdzZ96BYEAH0TrzMKXFm7hALvtVhMrE9j4jIdY3vNc8vN90r6oI%26adurl%3D&documentReferer=https%3A%2F%2Fwww.ranksays.com%2F&ancestorOrigins=https%3A%2F%2Fwww.ranksays.com&random=9868186286741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c9e6c9f66d9d05dfeb23b7b2e06c874a0f2d278bbae528100da8ec6a49e6729b

Request headers

Host: hal90007.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=21d783071b6cde61
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

Date: Thu, 29 Jul 2021 01:07:56 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 29 Jul 2021 02:07:56 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2050
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 00FA 43 B
702 B 53ms
52ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2224451&v=15314&q=344291&r=235229&pref1=14851400008044200719594011670007&pv=1

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:55 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 907F 1 KB
749 B 6ms
5ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 28 Jul 2021 11:56:19 GMT
expires: Thu, 29 Jul 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 47496
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 00FA 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d3cf2207d0b8e3159ac9904739c7296157531556572718d9dee1084302badef

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEMhWb2kgS4axf0zRaYfOf8Q&google_cver=1&google_push=AYg5qPL2sPRwzNvBZpvdOUht8zgazYIjX7PxR9OfCVzDXujgwIldko8E5EsYxOoaE7Pm-bUDnkjnM860jmEAEO...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPL2sPRwzNvBZpvdOUht8zgazYIjX7PxR9OfCVzDXujgwIldko8E5EsYxOoaE7Pm-bUDnkjnM860jmEAEObkV4...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPL2sPRwzNvBZpvdOUht8zgazYIjX7PxR9OfCVzDXujgwIldko8E5EsYxOoaE7Pm-bUDnkjnM860jmEAEObkV4wH_ERfFtYNSA

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5MDE0ODkxODgwMjM4MDk0Mg%3D%3D&google_push=AYg5qPL2sPRwzNvBZpvdOUht8zgazYIjX7PxR9OfCVzDXujgwIldko8E5EsYxOoaE7Pm-bUDnkjnM860jmEAEObkV4wH_ERfFtYNSA
Date: Thu, 29 Jul 2021 01:07:56 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELsdeyNtaLD19sc4OzvWW2o&google_cver=1&google_push=AYg5qPKq2TmDsd9zaVKL1U06rn3lvfYkEx6LBivm7yGuLTCSQJ9wdvU7WHPnMnh55hdpASOKNzs-oxthRo...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELsdeyNtaLD19sc4OzvWW2o&google_cver=1&google_push=AYg5qPKq2TmDsd9zaVKL1U06rn3lvfYkEx6LBivm7yGuLTCSQJ9wdvU7WHPnMnh55hdpASOKNzs-oxthRo...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPKq2TmDsd9zaVKL1U06rn3lvfYkEx6LBivm7yGuLTCSQJ9wdvU7WHPnMnh55hdpASOKNzs-oxthRov7nq6QTQpcsS4LpP9VPA&google_hm=MDMwMzAwMDNfNjEwM...

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPKq2TmDsd9zaVKL1U06rn3lvfYkEx6LBivm7yGuLTCSQJ9wdvU7WHPnMnh55hdpASOKNzs-oxthRov7nq6QTQpcsS4LpP9VPA&google_hm=MDMwMzAwMDNfNjEwMWZmNmMwZGJhZQ%3D%3D

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 29 Jul 2021 01:07:56 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPKq2TmDsd9zaVKL1U06rn3lvfYkEx6LBivm7yGuLTCSQJ9wdvU7WHPnMnh55hdpASOKNzs-oxthRov7nq6QTQpcsS4LpP9VPA&google_hm=MDMwMzAwMDNfNjEwMWZmNmMwZGJhZQ%3D%3D
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEPSOZ85RqBPFZEYOy2QNb4E&google_cver=1&google_push=AYg5qPLS4Te8_NhfWvRFcI-Z35F34YWpi5QcbyP3f0V46q-IBUaGM6fHwaU9B_IcBHvgLNjvzyhvBB0cqY6u_gDeFn0MVixYrHJdTA
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLS4Te8_NhfWvRFcI-Z35F34YWpi5QcbyP3f0V46q-IBUaGM6fHwaU9B_IcBHvgLNjvzyhvBB0cqY6u_gDeFn0MVixYrHJdTA&google_hm=w1CbKHmyxRo8kbddgRdnlg==

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLS4Te8_NhfWvRFcI-Z35F34YWpi5QcbyP3f0V46q-IBUaGM6fHwaU9B_IcBHvgLNjvzyhvBB0cqY6u_gDeFn0MVixYrHJdTA&google_hm=w1CbKHmyxRo8kbddgRdnlg==

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:55 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLS4Te8_NhfWvRFcI-Z35F34YWpi5QcbyP3f0V46q-IBUaGM6fHwaU9B_IcBHvgLNjvzyhvBB0cqY6u_gDeFn0MVixYrHJdTA&google_hm=w1CbKHmyxRo8kbddgRdnlg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 3n78qhvtbuk0lsrsslk65iug9qes03q6

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKJL3siy7xlfJ8gOHKwisp0&google_cver=1&google_push=AYg5qPL4q9Mm931lvJBpZ8JVoWVht0RIcmwwcJtHie-meuSQQQI9qn9wzsnMwUxfvHdgM_g0a0O2VD8zPxIQkJZZb...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKJL3siy7xlfJ8gOHKwisp0&google_cver=1&google_push=AYg5qPL4q9Mm931lvJBpZ8JVoWVht0RIcmwwcJtHie-meuSQQQI9qn9wzsnMwUxfvHdgM_g0a0O2VD8zPxIQkJZZb...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPL4q9Mm931lvJBpZ8JVoWVht0RIcmwwcJtHie-meuSQQQI9qn9wzsnMwUxfvHdgM_g0a0O2VD8zPxIQkJZZb94dxuJHE87hiw&google_hm=4e76caf3ea19e792496d...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPL4q9Mm931lvJBpZ8JVoWVht0RIcmwwcJtHie-meuSQQQI9qn9wzsnMwUxfvHdgM_g0a0O2VD8zPxIQkJZZb94dxuJHE87hiw&google_hm=4e76caf3ea19e792496de934

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 29 Jul 2021 01:07:56 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPL4q9Mm931lvJBpZ8JVoWVht0RIcmwwcJtHie-meuSQQQI9qn9wzsnMwUxfvHdgM_g0a0O2VD8zPxIQkJZZb94dxuJHE87hiw&google_hm=4e76caf3ea19e792496de934
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEK4PFpCqdDDA1ZgmFKCTKvE&google_cver=1&google_push=AYg5qPLatETDGhheHUqU0A2vCLUtweGOgW1zxzoEt2gPslbjzBaPA0xmEmuHNqcwUdX_ZeEHKWQNQQf1SWCNaNai...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLatETDGhheHUqU0A2vCLUtweGOgW1zxzoEt2gPslbjzBaPA0xmEmuHNqcwUdX_ZeEHKWQNQQf1SWCNaNaiQTcnCSeCYMbjJw

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLatETDGhheHUqU0A2vCLUtweGOgW1zxzoEt2gPslbjzBaPA0xmEmuHNqcwUdX_ZeEHKWQNQQf1SWCNaNaiQTcnCSeCYMbjJw

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 29 Jul 2021 01:07:56 GMT
via: 1.1 c202f63846a430afd2d556266be8b50c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLatETDGhheHUqU0A2vCLUtweGOgW1zxzoEt2gPslbjzBaPA0xmEmuHNqcwUdX_ZeEHKWQNQQf1SWCNaNaiQTcnCSeCYMbjJw
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: L2N2Qs2krsFlMyB42FnC4KWKqAO-GVDHy8qN-kKHjI9B5LuWTg_5Eg==

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 907F
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEOFEVA0sQNWD4udxQZ46evI&google_cver=1&google_push=AYg5qPJzWBemoM6smCQTxGALLzxf9yKAinIg0-55UnRVC8pHRVpYgHBBzoePCWJ-AHmXBrmPBPL8PJ...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJzWBemoM6smCQTxGALLzxf9yKAinIg0-55UnRVC8pHRVpYgHBBzoePCWJ-AHmXBrmPBPL8PJTbavQMJObFXhk0w6NNyN7Gyw&google_hm=NjkzMDMz...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJzWBemoM6smCQTxGALLzxf9yKAinIg0-55UnRVC8pHRVpYgHBBzoePCWJ-AHmXBrmPBPL8PJTbavQMJObFXhk0w6NNyN7Gyw&google_hm=NjkzMDMzNjMxNTM4NzA2MTAzNw%3D%3D

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Jul 2021 01:07:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJzWBemoM6smCQTxGALLzxf9yKAinIg0-55UnRVC8pHRVpYgHBBzoePCWJ-AHmXBrmPBPL8PJTbavQMJObFXhk0w6NNyN7Gyw&google_hm=NjkzMDMzNjMxNTM4NzA2MTAzNw%3D%3D
date: Thu, 29 Jul 2021 01:07:55 GMT
content-length: 0

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame 907F 42 B
233 B 309ms
90ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEOKIZsSWy9GOAKPaXq2fKKc&google_cver=1&google_push=AYg5qPI7JOBEoPONkOyPOsruK5ZTtsd-PKuDmNzFWn3DjzwWSPGZuE9fQrRKUYSY8ywY7NMUB6JCauSYbuNo59RSN13RUFeIfxW-TM8
Requested by: Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Jul 2021 01:07:56 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 907F 0
12 B 30ms
29ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L1lGzVwKPrdSov3gGDgdPBlrsYdzIoCJ0z0zM9ojgzY2ZvbD56DZQodVLtj4quqRPngTAEkA

Requested by

Host: cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com
URL: https://cd1f3d3207dd347b3c7798714a2cfe18.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS